NoName057(16)’s Gamified DDoS Attacks Are Designed to Undermine Trust

Aalto University research presents NoName057(16) as more than a conventional hacktivist collective. The pro-Russian group combines crowdsourced distributed denial-of-service (DDoS) attacks with propaganda, ideological recruitment and financial incentives—a model the study places at the intersection of hacktivism, geopolitical cyber activity and cybercrime. 12

The central lesson is that a short-lived website outage can serve a longer political purpose: making institutions appear vulnerable, amplifying fear and encouraging the public to distrust the organisations responsible for essential services.

The group’s real objective is broader than disruption

NoName057(16) has launched thousands of DDoS attacks against public and private organisations, mainly in NATO member states and other European countries, including Finland. 2 A DDoS attack floods a service with requests or traffic so that legitimate users cannot access it. The immediate consequence may be temporary unavailability, but Aalto’s analysis says the disruption is also used as a platform for propaganda intended to delegitimise opponents. 2

That makes the campaign a hybrid threat. The technical operation creates a visible incident; the surrounding messaging turns that incident into a political narrative. The intended effect is not necessarily permanent technical damage, but anxiety, reputational harm and weaker confidence in governments, institutions and critical services. 12

How DDoSia recruits and coordinates volunteers

The group’s operating model depends on distributing much of the work across a volunteer network. Participants are recruited through Telegram and given access to DDoSia, the tool used to coordinate attacks against targets selected or promoted by the network. 23443

This lowers the technical barrier to entry. People do not need to develop sophisticated exploits to take part; they can contribute computing resources through a tool and follow the group’s campaign structure. The approach is crowdsourced, but centrally shaped through target selection, communication and performance incentives. 234

The result is a community that can be mobilised around political events and perceived support for Russia’s opponents while retaining some features associated with cybercrime-for-hire. Aalto therefore describes the model as blurring the boundaries between ideological hacktivism, geopolitical warfare and financially motivated cybercrime. 23

Why the “patriotic online game” framing matters

DDoSia is not presented simply as attack software. The project frames participation as a “patriotic online game,” encouraging contributors to see disruptive activity as nationalist or civic action rather than criminal conduct. 338

The game-like structure can help with recruitment and retention by giving participants a shared identity, visible goals and a sense of competition. Reporting on the project has also described ranking or performance-based incentives, although the exact mechanics and payment arrangements have changed across accounts and over time. 3944

This combination is strategically useful: ideology supplies motivation, the game format makes participation feel accessible and social, and financial rewards offer an additional reason to keep contributing.

Cryptocurrency adds a commercial incentive

The project has offered rewards in cryptocurrency to participants who contribute to successful attacks. Earlier reporting cited payments of up to 80,000 Russian rubles—approximately $1,200 at the time—for successful DDoS activity. 46

The reward system matters because it complicates the usual distinction between a politically motivated volunteer and a paid cybercriminal. Participants may be attracted by pro-Russian messaging, by the social experience of the group, by the competitive format or by the prospect of payment. Aalto’s findings indicate that these motives can operate together rather than separately. 2

The available evidence does not establish that every participant is paid or that every attack is motivated by money. The stronger conclusion is that cryptocurrency gives the group another mechanism for recruiting and incentivising contributors alongside its ideological appeal.

Finland illustrates the model’s scale

According to Aalto University, NoName057(16) launched 23 rounds of attacks against Finnish targets from January 7, 2025, affecting 129 public and private organisations. The targets included Parliament and other government institutions, municipalities, banks and financial institutions, and critical-infrastructure service providers. Aalto also reported an increase in attacks after Finland joined NATO in 2023. 1

Across Europe, the immediate impact of such attacks can be a temporary loss of access to online services. The broader impact is the perception that public bodies, financial organisations or essential-service providers cannot reliably protect their digital front doors. That perception is valuable to an attacker even when systems recover quickly.

What Operation Eastwood changed—and what it did not prove

Between July 14 and 17, 2025, Europol and Eurojust coordinated Operation Eastwood, a multinational action against NoName057(16)’s people and infrastructure. Authorities from Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands and the United States took simultaneous action. 17

The operation disrupted an attack infrastructure comprising more than 100 computer systems worldwide and took a major part of the group’s central server infrastructure offline. 17 Other reporting on the operation described arrests, searches and arrest warrants alongside the infrastructure disruption. 1723

That was a significant operational setback, but “disrupted” is not the same as permanently eliminated. The available evidence does not show that the underlying recruitment model, political messaging or propaganda effects ceased. A resilient crowdsourced structure can potentially adapt when particular servers or administrators are removed.

What organisations should do differently

Aalto’s analysis points to a response that is wider than ordinary DDoS mitigation. Organisations should account for an attacker’s political objectives, operating model and motivations in threat modelling, risk assessment and incident management—not treat every incident solely as an availability problem. 2

That means pairing technical preparations with communications planning:

• Prepare for the narrative as well as the outage. Identify which services, institutions and public audiences could be affected, and plan how to explain an incident accurately.
• Coordinate security and communications teams. Cybersecurity staff can establish what happened and what remains available; communications teams can address rumours, intimidation and misleading claims.
• Communicate transparently and credibly. Minimising or concealing an attack can leave a vacuum for hostile propaganda. Clear updates can help prevent temporary disruption from being portrayed as institutional collapse. 2
• Measure recovery beyond uptime. Restoring a website is necessary, but organisations should also assess public confidence, reputational damage and whether false claims about the incident are spreading.

The study’s most important implication is therefore strategic. DDoSia turns ordinary internet users into participants in a coordinated influence operation, while making cyber disruption look like a game. Defending against it requires both resilient infrastructure and the ability to contest the story built around an attack.