Home › Threat Actors › NoName057(16)
← All Threat Actors
Nation-State high Russia (assessed)

NoName057(16)

Pro-Russian hacktivist group (state-aligned, formal relationship unconfirmed) · Political / ideological -- retaliation against NATO and Western governments perceived as hostile to Russia

Reports 1
Active Since 2022
Last Reported 27 May 2026
Sectors Targeted critical-infrastructure, communications

Tactics, Techniques & Procedures (TTPs)

  • High-volume DDoS campaigns against public-facing government and infrastructure websites
  • DDoSia volunteer toolkit enabling distributed attack participation
  • Use of hosting infrastructure in EU member states to evade sanctions (Stark Industries, WorkTitans)
  • Coordinated campaign timing during elections, diplomatic events, and military aid announcements
  • Targeting of financial institutions, transport operators, and port infrastructure

Known Targets

European government websites (NATO member states)Danish government servicesTransport operators and port infrastructureFinancial institutionsUkrainian government and media

Analyst Notes

Active since Russia's invasion of Ukraine, February 2022. Conducts sustained DDoS campaigns against governments and organisations in countries perceived as supporting Ukraine. Primary hosting infrastructure (Stark Industries, WorkTitans B.V.) was seized by Dutch FIOD authorities in May 2026 -- 800+ servers seized, two suspects arrested. Sanctions evasion via shell company transfers (Stark Industries IP ranges moved to WorkTitans after EU sanctions) demonstrated deliberate circumvention of law enforcement pressure. Group has consistently reconstituted after prior disruptions.

Also Known As

NoName057NN057(16)

MITRE ATT&CK Techniques

T1498 Network Denial of Service T1498.001 Network Denial of Service: Direct Network Flood T1583 Acquire Infrastructure T1588 Obtain Capabilities

Intelligence Reports

Briefing critical-infrastructurecommunications

Dutch Authorities Seize 800 Servers Tied to Russian Cyber-Attack Infrastructure

Dutch financial crime investigators arrested two suspects and seized 800 servers connected to Stark Industries, a hosting network linked to NoName057(16) DDoS campaigns against European governments and critical infrastructure.

27 May 2026 · 4 min read