Poland Under Intensified DDoS Siege: Weekly DDoS Threat Intelligence Analysis

Poland faced an intensified DDoS campaign during the 12–18 January 2026 period, with SOCRadar counting 4,087 attack entries across 149 unique domains and 137 unique IP addresses, the majority directed at Polish infrastructure. According to NoName057(16), a pro-Russian hacktivist collective, the operation used its DDoSia tool and involved four vectors including TCP floods and HTTP floods, executed via Telegram channels with frequent target updates.

Poland accounted for 67.1% of attacks (2,744), while Ukraine received 13.3% (545), and the rest spread across other regions, the EU, and the UK, reflecting a dual-objective strategy to press both Poland and Ukraine. The attacks preferentially hit government and private sector targets, with private sector services constituting 71.3% and government services 20.5% of the focus, including critical financial and transportation infrastructure such as the BLIK payment system and MPK Poznań.

The campaign relied heavily on TCP syn floods (33.7%) and HTTP floods (together 29.4%), with port 443 (HTTPS) bearing 61.3% of attacks, indicating a mix of volumetric and application-layer methods to exhaust resources. NoName057(16)’s operations are described as rotating geographically between weeks and escalating in intensity, underscoring the need for reinforced DDoS defences across NATO members and Ukraine.