GINC-APT-0318 · Hacktivist

NoName057(16)

Also 05716nnm, Nnm05716, NoName, NoName057, NoName05716.

Category: Hacktivist · Political or nationalist, often disruption and leaks.
Origin: Russia(medium confidence)
Motivation: Denial of service
Sources: 6 sources carry it
Identifier: GINC-APT-0318 · noname057-16

What it is

NoName057(16) is performing DDoS attacks on websites belonging to governments, news agencies, armies, suppliers, telecommunications companies, transportation authorities, financial institutions, and more in Ukraine and neighboring countries supporting Ukraine, like Ukraine itself, Estonia, Lithuania, Norway, and Poland.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Other names: 05716nnm, Nnm05716, NoName, NoName057, NoName05716

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

ThreatActor.info (Malpedia et al.)Russia

Targets

Countries: Czech Republic, Denmark, Estonia, Lithuania, NATO, Norway, Poland, Ukraine
Sectors: Financial, Government, Military, Telecommunications, Transportation

Tools

The tools and malware families the sources tie to it.

mySingleMessenger

Sources

Malpedia malpedia.caad.fkie.fraunhofer.de