Coordinated Hacktivist Threat Activity Targeting Belgium

A coalition of eight hacktivist threat groups with pro-Russian and pro-Palestinian affiliations has announced a campaign targeting Belgium’s internet infrastructure, with DDoS operations, OT environment targeting, and potential data exposure claims expected over the next 24 to 48 hours. The groups’ identities remain undisclosed, though six of them are described as pro-Russian, one as pro-Kurdish, and one as pro-Moroccan, and their communities are relatively small, averaging around 500 members.

No operational claims or attack statements had been observed from the eight-group coalition to date, while NoName057(16) continues to claim DDoS attacks against Belgian entities. Since November 2, NoName057(16) has publicly claimed multiple attacks on both public and private sector organisations in Belgium, including Citydev Brussels, the Walloon Parliament’s secure document exchange platform, Vivaqua, and several regional portals and municipalities; further targets were named in follow-up statements.

As of November 5, NoName057(16) indicates that attacks are ongoing, independently from the eight-group coalition, which may escalate to defacement, data exposure, or OT/SCADA targeting if activity increases.