The NoName057(16) collective and DDoS offensives in support of the Russian narrative

Threat Discovery is an editorial space of Telsy and TS-WAY dedicated to in-depth analysis of cyber threat intelligence at a global level.

The information reported is the outcome of the collection and analysis work done by TS-WAY specialists for the TS-Intelligence platform.

This article presents a profile of the pro-Russian hacktivist collective NoName057(16).

An “unnamed” adversary with a definite identity

The NoName057(16) collective operates in the hacktivist field by coordinating DDoS offensives against targets deemed adverse to the Russian cause. Its campaigns aim to attract global attention and direct public opinion in favor of Kremlin policy. Compared to other pro-Russian opponents, NoName057(16) stands out for its clear ideological positioning and the number of claims it has posted on its Telegram channels.

Its establishment dates back to March 2022, coinciding with the start of Russia’s special military operation in Ukraine. In the delicate transition constituted by the attempted mutiny of the Wagner in June 2023, the group attested to its alignment with the positions of Vladimir Putin’s government. While other collectives from the same front sided with the march on Rostov, NoName057(16) declared its aversion to the militia founded and led by the late Evgenij Prigožin.

Claims of attacks for demonstration purposes

The volume of hacktivist offensives that NoName057(16) has reported over the past two years cannot be compared with any other formation engaged in pro-Russian activities. Between February 2023 and July 2024, its claims against individual targets, posted on Telegram channels in Russian and English, are several thousand.

Victimology includes entities from multiple sectors, both public and private, with particular insistence on government and defense, transportation and logistics, finance, and energy. Targets are located in Ukraine and all countries that have sided with Kyiv. They are joined by administrative and governmental bodies of the European Union and organizations affiliated with NATO.

The claims are often accompanied by messages motivating the choice to target specific realities or individual countries. From time to time, NoName057(16) stigmatizes statements by ministers and presidents in favor of humanitarian and military aid to Kyiv; rides on the motives of civilian demonstrations to increase social tension within EU member states; and makes itself heard at political summits and international summits.

The strategy of alliances among hacktivists

This year, pro-Russian hacktivist groups have been active in the elections for the European Parliament and those in France and the United Kingdom. In particular, NoName057(16) led DDoS offensives calling together the People Cyber Army, HackNet, CyberDragon, 22C, CoupTeam, Root@kalid, and Usersec collectives.

The strategy of alliances is frequently adopted by these kinds of adversaries. Last May, for example, several collectives – among which People Cyber Army and HackNet appeared – came together in High Society, an international alliance that also targeted several Italian targets.

In recent weeks, NoName057(16) has partnered with the Russian Hacker Council Global, the pro-Palestinian Alixsec, and AzzaSec, a newly formed Italian team that has declared itself both pro-Russian and pro-Palestinian.

All participants in NoName057(16) initiatives adhere to the “DDoSia Project,” named after the Dosia bot made available on a dedicated Telegram channel.

Telsy and TS-WAY

TS-WAY is a company that develops technologies and services for medium and large-sized organizations, with a unique in Italy for cyber threat intelligence expertise. Founded in 2010, TS-WAY has been part of Telsy since 2023.

Is configured as an effective extension of the client organization, supporting the in-house team for intelligence and investigation activities, cyber incident response, and systems security verification activities.

TS-WAY’s experience is internationally recognized and is corroborated by large private organizations in finance, insurance, defense, energy, telecommunications, transportation, technology, and by government and military organizations that have used the services of this Italian company over time.

TS-WAY’s Services and Solutions

With several vertical teams of security analysts and researchers with technical and investigative expertise, and internationally recognized experience, TS-WAY provides all the assistance needed to align an organization’s security program with its risk management objectives.

Its services offer a preventive and comprehensive approach to security to protect clients’ assets and business continuity.

Its technology solutions transform global threat data into strategic, tactical, operational, and technical intelligence.

TS-Intelligence

TS-Intelligence is a proprietary, flexible, and customizable solution that provides organizations with a detailed risk landscape.

It is presented as a Web-usable, full-API platform that can be operated within an organization’s defensive systems and infrastructure, to strengthen protection against complex cyber threats.

Constant research and analysis on threat actors and emerging networked threats, both in APT and cybercrime, produces a continuous information flow of an exclusive nature that is made available to organizations in real-time and processed into technical, strategic, and executive reports.

Learn more about TS-WAY’s services.