Noname057(16)

Threat Actor updated 5 months ago (2024-05-04T18:18:19.174Z)
Download STIX
Preview STIX
NoName057(16), a threat actor group, has been increasingly active in executing attacks with malicious intent, primarily targeting government websites in Estonia, Lithuania, and Poland. The group's activities have become more news-driven, indicating a strategic shift in their operations. In comparison to other hacktivist groups like Killnet, NoName057(16) has been significantly more active, launching 544 attacks during a recent period as opposed to Killnet's 11. The Canadian government has issued an alert on NoName057(16)'s activities, advising organizations to consider third-party DDoS solutions to manage the nuisance activity and prevent significant malicious actions. The threat actor group has seen an exponential growth of 2,400% since its emergence last summer, with more than 10,000 threat actors becoming active members of NoName057(16)'s crowdsourced DDoSia platform. This pro-Russian hacktivist operation communicates via Telegram channels, one in Russian and another in English, boasting over 45,000 subscribers. Despite causing short-lived disruptions, according to cybersecurity firm SentinelOne, the group's DDoS incidents have had little to no wider consequences. NoName057(16) is continuously developing its capabilities, making efforts to make their malware compatible with multiple operating systems. This reflects their intention to target a broader set of victims by making their malware accessible to a large number of users. Analysts at Sekoia.io predict that the group will continue to strengthen the security of their software, driven by their active community and increasing scrutiny from the CTI community. As such, it is crucial for organizations to stay updated with the latest cybersecurity threats and emerging trends to effectively counteract these potential risks.
Description last updated: 2024-05-04T18:04:47.644Z
What's your take? (Question 1 of 1)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Ddosia is a possible alias for Noname057(16). Ddosia, a project launched by the pro-Russian hacktivist group NoName057(16), is a significant threat actor that has been facilitating continuous DDoS attacks on government and private organization websites. Initiated in July 2022, the Ddosia project mirrors similar initiatives like the pro-Ukrainia
2
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Telegram
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.