NoName057(16)
NoName057(16) is classified as hacktivist.
- Telegram channels
- 1
- Malware families
- 1
- Also known as
- 3
- Last activity
- Oct 23, 2026
NoName057(16) is performing DDoS attacks on websites belonging to governments, news agencies, armies, suppliers, telecommunications companies, transportation authorities, financial institutions, and more in Ukraine and neighboring countries supporting Ukraine, like Ukraine itself, Estonia, Lithuania, Norway, and Poland.
The group is associated with 1 malware families.
Its latest activity was recorded on Oct 23, 2026.
Also known as: NoName057, 05716nnm, Nnm05716
The group is associated with 1 malware families.
Malware families
- Dosia
Published reports on this actor:
- https://decoded.avast.io/martinchlumecky/bobik/
- https://www.sentinelone.com/labs/noname05716-the-pro-russian-hacktivist-group-targeting-nato/
- https://www.gov.pl/web/special-services/russian-cyberattacks
Source: MISP Galaxy, Malpedia.
What does a hacktivist do?
Hacktivist groups choose targets based on political and current events. Denial-of-service (DDoS) attacks, website defacements and publication of stolen data are common; announcements are made on Telegram channels.
Which defenses matter most?
- Use denial-of-service protection and a content delivery network for your website and APIs.
- Keep your content management system and plugins updated, and do not expose the admin panel to the internet.
- Monitor announcement channels: target lists are shared before attacks.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.