DDoSia Campaign Targeting Belgium: Weekly DDoS Threat Intelligence Analysis

Between 8 and 14 December 2025, SOCRadar identified a coordinated DDoS campaign conducted by the pro-Russian threat actor NoName057(16), with 4,435 recorded attack entries across 155 unique domains and 144 unique IP addresses in 15+ countries. The activity focused mainly on Belgium and Ukraine, with Belgium accounting for 57.3% of all attack entries and Ukraine 22.8%, while international, EU, and network-related entities also faced spillover.

The majority of assaults targeted private sector infrastructure, particularly telecommunications, utilities, and industrial organisations, alongside high-value government and defence services. DDoSia employed a multi-vector approach, most commonly deploying SYN Floods (25.5%), HTTP GET floods (23.3%), and ACK Floods (14.5%), with a heavy emphasis on port 443 for public-facing web services and encrypted business systems.

This activity is described as persistent, coordinated, and strategically motivated, and the report anticipates that similar campaigns may continue during periods of geopolitical tension.