Cyberattacks Targeting International Domains: Weekly DDoS Threat Intelligence Analysis

Between 22 and 28 December 2025, SOCRadar identified a large, coordinated DDoS campaign attributed to the pro-Russian threat actor NoName057(16) and their project DDoSia, with 6,567 recorded attack entries targeting 158 unique domains and 161 unique IP addresses across multiple European nations. Finland accounted for 53.3% of all attacks (3,503), followed by France with 11.8% (778), and international domains comprising 23.5% (1,542), with other countries making up 11.3% (744).

The campaign used a multi-vector approach, predominantly targeting port 443 (HTTPS) in 72.6% of attacks, and consisted of HTTP GET floods, SYN floods, and various application-layer methods such as HTTP/2 and nginx_loris. NoName057(16) operates via a crowdsourced, Telegram-driven model, sustaining campaigns over weeks and updating target lists multiple times per day.

The analysis highlights a focus on Finland’s critical infrastructure and government services, alongside international infrastructure and other European targets, signalling a strategic effort to pressure NATO member states and allied services. SOCRadar notes the campaign’s persistence and intends to provide ongoing intelligence for organisations requiring detailed threat insights and mitigation guidance.