2 ATT&CK Techniques Drive NoName057(16) DDoS Campaigns
PurpleOps assesses NoName057(16) as an active pro-Russian hacktivist group focused on politically motivated disruption, last observed active on 2026-11-09. PurpleOps data shows the actor relies exclusively on 2 ATT&CK techniques to execute sustained distributed denial-of-service campaigns against target organizations.
Who is NoName057(16)?
PurpleOps data tracked the actor in the 7 days to 2026-11-10. During this period, the group conducted sustained distributed denial-of-service campaigns against Canadian organizations and Belgian websites. The group operates without a monetary motive and relies instead on public messaging to claim responsibility for network disruptions.
Evidence collection reveals heavy reliance on public channels for campaign coordination. Out of 7,246 total items collected by PurpleOps, Telegram activity accounts for 7,176 items. A small number of threat-feed reports and dark-web items supplement this dataset. The high volume of Telegram content confirms ongoing public messaging and campaign coordination. PurpleOps data contains tangential noise within the channel data rather than group-attributed activity. This noise includes a defacement attributed to another group and an unrelated supervisory control and data acquisition report. The evidence does not include ransomware, exploit, breach data, or technical indicators; analysts cannot assess intrusion tradecraft from this dataset.
Which techniques does NoName057(16) use?
The group limits its technical operations to distributed denial-of-service campaigns. Because the dataset lacks technical indicators of compromise, defenders focus entirely on the ATT&CK techniques the actor employs for network disruption.
The first technique is T1498 Network Denial of Service. The group targets network bandwidth and infrastructure components to prevent legitimate users from accessing services. Defenders facing T1498 attacks track degraded network performance, complete loss of external connectivity, or unresponsive public-facing applications.
The second technique is T1499 Endpoint Denial of Service. The group exhausts system resources on specific target servers. This technique degrades processor, memory, or disk resources on targeted application servers, and renders the services unavailable to legitimate network requests.
How do I detect NoName057(16) activity?
Without technical indicators for NoName057(16), security teams defending Canadian organizations and Belgian websites deploy behavioral detections for network and endpoint attacks. To detect the group's Network Denial of Service campaigns, defenders configure alerts on edge network appliances using NetFlow or sFlow telemetry. Network engineers defending against pro-Russian hacktivist disruption configure ingress filtering on perimeter routers to drop packets with spoofed source network addresses. Security teams set volumetric thresholds based on historical bandwidth baselines, and trigger automated alerts in the security information and event management system when inbound traffic exceeds expected patterns. Firewall administrators review external firewall logs to identify traffic spikes originating from the group's infrastructure. Intrusion detection systems parse network traffic to identify repetitive packet payloads that match the group's sustained automated flood attacks. Network operators monitor Border Gateway Protocol routing tables to identify routing anomalies associated with traffic misdirection during these large-scale disruption events. Security engineers deploy specialized hardware at the network edge to filter malformed datagram packets before the traffic consumes internal bandwidth. Teams monitor name server logs for query floods designed to saturate name resolution capabilities during politically motivated attacks.
Detecting the group's Endpoint Denial of Service requires host-level logging, application performance monitoring, and resource telemetry. Defenders monitor endpoint detection and response telemetry for sustained spikes in processor and memory usage on external-facing servers targeted by the group. System administrators configure alerts for application crash events, failed process allocations, and unexpected service restarts in Windows Event Viewer or Linux syslog. Web administrators parse Windows or Apache web server access logs to identify anomalous spikes in web requests targeting resource-intensive database queries on Belgian or Canadian web applications. Security personnel correlate load balancer health check failures with internal server metrics to confirm the resource exhaustion events. Defenders implement rate limiting on reverse proxies and ingress controllers to restrict the number of concurrent connections permitted from a source network block. Application developers instrument custom software logs to record transaction response times, and generate alerts when database query queues exceed predefined timeout thresholds. System engineers monitor hypervisor performance metrics to detect virtual machine resource starvation that results from application-layer denial of service conditions. Database administrators configure slow query logs to identify excessive transaction locks that result from targeted endpoint exhaustion attempts.
Organizations use BUGSY to track hacktivist campaigns and monitor Telegram channels for emerging threats. Analysts read updates on the PurpleOps blog. To track actor communications and protect infrastructure against politically motivated disruption, deploy our dark web monitoring solution.
