DDoSia Powers Affiliate-Driven Hacktivist Attacks

A public cybersecurity write‑up reports that a pro‑Russian hacktivist group known as NoName057(16) is using a volunteer‑distributed tool to disrupt government, media and institutional websites tied to Ukraine and Western interests, with activity dating back to 2022. The operation is centred on a custom platform called DDoSia, which allows individuals with minimal technical skill to participate in coordinated, hours‑long campaigns by receiving targets and settings from command‑and‑control servers.

According to SOCRadar, NoName057(16) runs a sustained, politically driven DDoS program that is more like an organised community operation than a classic botnet, emphasising efficiency and persistence over extreme bandwidth. The attackers employ a mix of application‑layer techniques, multivector campaigns, and distributed volunteers, while reporting campaign details through channels such as Telegram and X to mobilise supporters.

SOCRadar’s weekly threat intelligence notes that DDoSia now supports multiple attack methods and has evolved to be modular and multiplatform, with detection‑avoidance features including traffic randomisation and realistic client signatures. In a recent analysis, researchers highlighted that the group’s attacks are disruptive rather than destructive, often targeting sites with limited DDoS protection and leveraging volunteer nodes to sustain pressure for extended periods. 7 January 2026.