United Kingdom Under DDoS Siege: Weekly DDoS Threat Intelligence Analysis

Between 5 and 11 January 2026, the United Kingdom faced a concentrated DDoS campaign led by the pro-Russian threat actor NoName057(16) and their DDoSia project, according to SOCRadar. The seven-day operation produced 1,812 recorded attack entries across 86 unique domains and 87 unique IP addresses, with 85.2% of the activity (1,543 attacks) occurring in the United Kingdom and the remainder spread across unknown international targets.

Government infrastructure bore the heaviest impact at 54.8%, followed by private sector organisations (31.2%), with critical infrastructure including transportation and maritime components also affected. The campaign employed a multi-vector approach, dominated by TCP floods and HTTP floods, and concentrated attacks on port 443 (HTTPS) for 70.3% of incidents.

NoName057(16) operates a crowdsourced botnet framework, using Telegram channels for target updates and participant recruitment, and has consistently rotated geographic focus across campaigns, with the UK now a primary target during this period. SOCRadar notes the campaign’s high level of operational persistence and suggests organisations strengthen multi-layered protections and threat intelligence monitoring to mitigate future risks.