cyber.hendryadrian.com
Security Report · darkowl.com

DarkOwl Finds NoName057(16) Sustained DDoS Claims and Expanded Hacktivist Ties

· Original article ↗

Summary

DarkOwl analyzed NoName057(16)’s English Telegram channel from October 2025 to September 2026, finding 666 DDoS claim posts and growing partner amplification. The group’s victim and intrusion claims remain unverified.

Key points

  • DarkOwl reviewed 2,825 channel messages from 27 October 2025 through 30 September 2026, including 1,228 group-authored text posts and 230 distinct forwards.
  • The group made 666 DDoS claim posts naming 3,421 alleged targets, estimated at about 2,200 unique organizations; DarkOwl says these claims were not independently verified.
  • Ukraine, Germany, Denmark, France, Italy, and the United Kingdom were among the most targeted countries; claim posts often linked target selection to geopolitical events.
  • Forwarded content rose to 36 posts in August and 49 in September 2026, while the group announced 13 alliances during the review period.
  • The group increasingly claimed intrusions involving ICS and CCTV; 45 posts used its #BrokenByte tag. These claims were not independently verified.
  • DarkOwl assesses with moderate confidence that NoName057(16) is evolving into a coalition hub. It recommends that organizations review internet-exposed OT/HMI and CCTV interfaces and prepare for short-duration DDoS campaigns.

Article Details

Publisher
DarkOwl
Report Period
2025-10-27 to 2026-09-30
Scope
Review of messages from NoName057(16)'s English-language Telegram channel.
Sample Size
2,825 messages in the channel export.
Key Statistics
  • The export contained 666 DDoS claim posts listing 3,421 alleged targets; approximately 2,200 were estimated to be unique. Victim figures are group claims and were not independently verified.
  • The channel posted on 338 of 339 days in the review period.
  • The report identified 13 publicly announced alliances during the period.
  • 45 posts carried the #BrokenByte tag for claimed ICS and CCTV activity.
  • The report identified 107 posts promoting the DDoSia tool and volunteer program.
Recommendations
  • Organizations in the most-targeted countries, particularly public-sector, transport, energy, and defense-industrial entities, should prepare for short-duration DDoS campaigns timed to political announcements about support for Ukraine.
  • Review internet-exposed OT/HMI and CCTV interfaces in light of the reported intrusion claims.

MITRE ATT&CK

T1498 · Network Denial of ServiceThe article describes NoName057(16)'s DDoS activity as flooding targeted websites with traffic.

Threat Actors

NoName057(16)The report identifies the group as a pro-Russian hacktivist group conducting coordinated cyberattacks and making DDoS and intrusion claims. The claimed victim figures and attacks were not independently verified.PalachProThe article names the group as an operational partner in claimed joint attacks with NoName057(16), including reported ICS activity.Z-Pentest AllianceThe article names the group as an operational partner in claimed joint attacks with NoName057(16), including reported ICS activity.

Products

Telegramcoordinated cyberattacks against countries and organizations supporting Ukraine. They are very active on Telegram where they often post claims of DDoS (Denial of Service) attacks on their victims. The group formed in

Tools

DDoSiathrough messaging apps like Telegram. Volunteers download a proprietary crowd-sourced attack tool called DDoSia onto their computers, which automatically floods targeted websites with traffic. Active participants are

Countries

Czech RepublicExamples include an Italian poultry-farm control system, an 850 kW industrial boiler in the Czech Republic, the Centrale Chalmazel hydroelectric plant in France and CCTV at a German water-treatment facility.DenmarkUkraine, Germany, Denmark, France, Italy and the United Kingdom are the most targeted countries.FranceUkraine, Germany, Denmark, France, Italy and the United Kingdom are the most targeted countries.GermanyUkraine, Germany, Denmark, France, Italy and the United Kingdom are the most targeted countries.ItalyUkraine, Germany, Denmark, France, Italy and the United Kingdom are the most targeted countries.Taiwantarget government websites, financial institutions, transport hubs, and media outlets in Ukraine, the US, Taiwan, and European NATO countries.Ukrainehacktivist group that conducts coordinated cyberattacks against countries and organizations supporting Ukraine. They are very active on Telegram where they often post claims of DDoS (Denial of Service) attacks onUnited KingdomUkraine, Germany, Denmark, France, Italy and the United Kingdom are the most targeted countries.

Industries

DefenseOrganizations in the most-targeted countries, particularly public-sector, transport, energy and defense-industrial entities, should expect continued short-duration DDoS campaigns timed to political announcements onEnergyGovernment portals, municipalities, transport (airports, ports, metro systems), energy utilities, telecoms, banking and defence-industrial firms dominate the target set.Governmentformed in March 2022, shortly after Russia’s full-scale invasion of Ukraine. They are known to target government websites, financial institutions, transport hubs, and media outlets in Ukraine, the US, Taiwan, andIndustrial control systemsBeyond DDoS, the group increasingly claims intrusions into industrial control systems (ICS) and CCTV (45 posts tagged #BrokenByte), runs a paid TOR tip platform, and publishes a “Tribunal” list of named foreignMediaof Ukraine. They are known to target government websites, financial institutions, transport hubs, and media outlets in Ukraine, the US, Taiwan, and European NATO countries.

Related Articles