Cyber Threat Alert: NoName057(16) Employs DDoSia to Target NATO-Affiliated Organizations

The pro-Russia hacktivist group NoName057(16), also known as 05716nnm, has continued to escalate its cyber offensive against NATO member states and European organizations.

Originating as a covert project within the Centre for the Study and Network Monitoring of the Youth Environment (CISM), the group operates under the direct influence of the Kremlin.

Intelligence indicates that CISM leadership provided the foundational support for the group, including infrastructure, target selection, and the development of their proprietary distributed denial-of-service (DDoS) tool, DDoSia.

Emerging as a successor to the “Bobik” botnet, the DDoSia Project represents the group’s primary offensive capability.

The tool is a crowdsourced botnet initiative that recruits volunteers via Telegram and incentivizes participation with cryptocurrency rewards.

The DDoSia client, developed in Go, is designed for accessibility, allowing individuals with limited technical expertise to launch sophisticated attacks.

The operational kill chain of DDoSia involves a distinct two-stage communication process with Command and Control (C2) servers.

In the first stage, the client authenticates via a POST request to the C2 server, transmitting encrypted system information including OS, kernel version, and CPU details within the Cookie header.

The payload is encrypted using AES-GCM, ensuring that volunteer machine fingerprints remain obscured. Upon successful validation, the server responds with a UNIX timestamp.

The second stage involves target acquisition. The client sends a GET request to retrieve attack configurations.

The C2 server returns an encrypted JSON object containing a target list and parameters for generating variable data to bypass caching mechanisms. This list dictates the victim host, port, and attack protocol, often focusing on HTTP/2 and standard web ports.

Infrastructure and Strategic Targeting

To maintain resilience, NoName057(16) employs a multi-tiered infrastructure. Tier 1 consists of ephemeral public-facing proxies that communicate with clients, rotating daily to evade blocklisting.

Tier 2 backend servers, protected by strict Access Control Lists (ACLs), host the core logic and target databases. This architecture ensures that even if proxy nodes are neutralized, the backend remains operational.

Analysis of activity between July 2024 and July 2025 highlights a high operational tempo, with an average of 50 unique targets attacked daily.

The attacks predominantly focus on government, transportation, and telecommunications sectors in nations opposing Russian geopolitical goals. Ukraine remains the primary target, followed closely by France, Italy, Sweden, and Germany.

In July 2025, the group faced significant pressure from Operation Eastwood, a coordinated international law enforcement effort.

Between July 14 and July 17, authorities executed 24 house searches across Czechia, France, Germany, Italy, Poland, and Spain.

The operation resulted in two arrests and the issuance of seven arrest warrants. Despite these actions, NoName057(16) dismissed the crackdown on their official Telegram channel, reaffirming their commitment to information operations supporting Russia.

Threat Profile Summary

FeatureDetails

Feature	Details
Group Aliases	05716nnm, Nnm05716, NoName057
Origin	CISM (Kremlin-backed)
Primary Tool	DDoSia (Go-based, AES-GCM encryption)
Key Targets	NATO Governments, Transport, Telecoms
Top Victim Nations	Ukraine (29%), France (6%), Italy (5%)
Attack Methods	TCP Floods (SYN/ACK), HTTP GET Floods, Slow Loris
Recent Events	Operation Eastwood (July 2025), Partnership with Z-Pentest

By late 2024, the group expanded its influence through the hybrid group Z-Pentest, formed in collaboration with the Cyber Army of Russia Reborn (CARR), signaling a sustained and evolving threat to Western operational technology assets

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.