3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
NoName057(16)

NoName057(16)

ID: 78dd1c3c3dfc6fcbbda95d743ab0e2f732121
Hacktivist Group DDoS Crew Hacktivism
Threat types: DDoS Attack, Hacktivism, Intrusion, Pro-Russia
Russia CAN, DNK, DEU, GRL, ISR, NZL, KOR, SWE, UKR, USA
Updated: 2026-04-15
Created: 2025-10-18
Progress: 95% Completeness: 100% Freshness: 100%
Operation zone: Canada, Denmark, Germany, Greenland, Israel, New Zealand, South Korea, Sweden, Ukraine, United States
Aliases Limited alias preview
N Nr NNM057(16) No******* No*********
ЗА********* ЗА************* — —
Showing 2 of 6 aliases in free preview.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: high
Actor Techniques page ATT&CK® Diagram

NoName057(16) is a pro-Russian hacktivist disruption network associated with sustained DDoS campaigns and a Telegram-mobilized volunteer model commonly labeled DDoSia. Europol/Eurojust described Operation Eastwood (July 2025) targeting the network’s infrastructure and supporters, while later U.S. government advisories continue to reference active opportunistic targeting by pro-Russia hacktivists including NoName057(16).


Technique Technique name Tactics Evidence
T1498 Network Denial of Service TA0040
  • 2025-12-18 — CISA names NoName057(16) among pro-Russia hacktivists conducting DDoS attacks. · ref
  • 2025-07-22 — Recorded Future analysis documents sustained targeting consistent with large-scale DDoS operations. · ref
T1585.001 Social Media Accounts TA0042
  • 2023-01-12 — SentinelOne describes Telegram-centric coordination and recruitment for the DDoSia model. · ref
T1583.001 Domains TA0042
  • 2023-01-12 — SentinelOne describes use of GitHub/GitHub Pages for distributing tooling (infrastructure supporting operations). · ref
Strategic Intelligence
Limited preview
Last updated: 2026-04-05T05:11:00+00:00

NoName057(16) — Pro‑Russian hacktivist collective with DDoS capabilities

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for Decision Makers — NoName057(16)


Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Saved Limited preview

Hunting Playbook — NoName057(16)


Upgrade to access the full hunting playbook.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Saved Limited preview
Last updated: 2026-02-25T01:26:14+00:00

IOC Appendix — NoName057(16) (Operational Seed Set)


More IOC context for Research. Full appendix for Analyst and Premium plans.
IOC Appendix now
Saved successfully.
OSINT Library
Saved Limited preview
Last saved: 2026-02-25T01:26:49+00:00

OSINT Library — NoName057(16)


2025-07-16 — Europol — “Global operation targets NoName057(16) pro-Russian cybercrime network (Operation Eastwood)”

Full OSINT references available for Research / Analyst.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/47
Address Verification SOCMINT
x.com/Non******** Restricted Not integrated
Address Verification SOCMINT
t.me/Non********* Restricted Not integrated
t.me/Non********* Restricted Not integrated
t.me/nnm******** Restricted Not integrated
t.me/non******** Restricted Not integrated
t.me/+Qd************** Restricted Not integrated
t.me/non**************** Restricted Not integrated
t.me/+Sa************** Restricted Not integrated
t.me/+ig************** Restricted Not integrated
t.me/nnm************ Restricted Not integrated
t.me/per*************** Restricted Not integrated
t.me/+WO************** Restricted Not integrated
t.me/+LR************** Restricted Not integrated
t.me/+Ug************** Restricted Not integrated
t.me/non***************** Restricted Not integrated
t.me/NNM************* Restricted Not integrated
t.me/NNM************ Restricted Not integrated
t.me/NNM************* Restricted Not integrated
t.me/NNM************ Restricted Not integrated
t.me/nnm************ Restricted Not integrated
t.me/+8P************** Restricted Not integrated
t.me/+-W************** Restricted Not integrated
t.me/+nC************** Restricted Not integrated
t.me/non************ Restricted Not integrated
t.me/fun*************** Restricted Not integrated
t.me/+eL************** Restricted Not integrated
t.me/+ui************** Restricted Not integrated
t.me/+qS************** Restricted Not integrated
t.me/nnm****** Restricted Not integrated
t.me/non************************* Restricted Not integrated
t.me/nnm******** Restricted Not integrated
t.me/+WZ************** Restricted Not integrated
t.me/+Cc************** Restricted Not integrated
t.me/non**************** Restricted Not integrated
t.me/+OD************** Restricted Not integrated
t.me/+NZ************** Restricted Not integrated
t.me/+2R************** Restricted Not integrated
t.me/DWM********* Restricted Not integrated
t.me/add*************************** Restricted Not integrated
t.me/add****************************** Restricted Not integrated
t.me/add********************* Restricted Not integrated
Address Verification SOCMINT
matrix.to Restricted Not integrated
Address Verification SOCMINT
in**@witha.name Restricted Not integrated
Address Verification SOCMINT
witha.name Restricted Not integrated
teletype.in/@no********************* Restricted Not integrated
telegra.ph/Man*********************** Restricted Not integrated
Address Verification SOCMINT
op7yiekgumt7po6mjgii4uewrwjydx5vhpa6y5gv7glftmw5srbwnaid.onion Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–12 of 29 images
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Pankratova / Propaganda Free Preview
Pankratova / Propaganda
Pankratova / Propaganda Free Preview
Pankratova / Propaganda
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Alliance with Holy League Free Preview
Alliance with Holy League
Propaganda Free Preview
Propaganda
Alliance with Morningstar Free Preview
Alliance with Morningstar
Onion website Free Preview
Onion website
DDoSia website Free Preview
DDoSia website
Affiliation with another group Free Preview
Affiliation with another group
Affiliation with another group Free Preview
Affiliation with another group
Affiliation with another group Free Preview
Affiliation with another group
Link-up Free Preview
Link-up
Affiliation with another group Free Preview
Affiliation with another group
Affiliation with another group Free Preview
Affiliation with another group
Affiliation with another group Free Preview
Affiliation with another group
Propaganda Free Preview
Propaganda
Affiliation with another group Free Preview
Affiliation with another group
Affiliation with another group Free Preview
Affiliation with another group
Affiliation with another group Free Preview
Affiliation with another group
Affiliation with another group Free Preview
Affiliation with another group
Actor Avatar Free Preview
Actor Avatar
Affiliation with another group Free Preview
Affiliation with another group
Actor Avatar Free Preview
Actor Avatar
Showing 4 of 29 images in preview mode. Additional evidence is restricted for Analyst and Premium plans.