NoName057(16)

THREAT ACTOR PROFILE

NoName057(16)

NoName057(16) is a pro-Russian hacktivist group active since March 2022 that runs sustained distributed denial-of-service campaigns against government and critical-infrastructure targets in Ukraine, NATO countries and Europe. Its attacks are powered by DDoSia, a crowdsourced botnet in which volunteers run the group's software in exchange for cryptocurrency rewards.

Country:

Pro-Russia (hacktivist)

Government / Critical infrastructure

First seen

2022

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

NoName057(16) and DDoSia

NoName057(16) is tracked mainly under its own name and its DDoSia tooling. It maps to one entry among the hacktivist groups we track, and its infrastructure has been tied in reporting to Russian state-aligned activity like that of Sandworm.

GROUP PROFILE

Crowdsourced DDoS aligned with Russian interests

NoName057(16) is a politically motivated hacktivist operation. It frames its attacks as retaliation against countries supporting Ukraine, and its campaigns track real-world events such as weapons deliveries and political statements.

Our record ties it to DDoS activity against government and public-sector targets. Insikt Group tracked the group hitting more than 3,700 unique hosts, mainly European government and public-sector sites, between 2024 and 2025, with campaigns correlating to Ukraine-related events.

The group's model is DDoSia: a Go-based, multi-OS tool distributed through Telegram that volunteers run to contribute their machines to coordinated floods, managed through a rapidly shifting multi-tier C2.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Volunteer recruitment into coordinated floods

The stages below come from NoName057(16) and DDoSia activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

DDoSia and supporting infrastructure

Initial Access

CVES EXPLOITED

DDoS operations, not CVE exploitation

NoName057(16) operates a crowdsourced DDoS model rather than exploiting software vulnerabilities for access, so this profile does not list a confirmed exploited-CVE set tied to the group. Detection should focus on the DDoSia client, the group's rotating multi-tier C2, and the flood patterns its botnet generates.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

DDoSia against NATO and European targets

Recent reporting tracks the group's campaigns and infrastructure.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through