ɫɫ��

First-of-its-kind research from Finland’s Aalto University’s School of Business reveals the modus operandi and operating model of the pro-Russian hacking group responsible for thousands of Distributed Denial of Service (DDoS) attacks against NATO and European targets. DDoS attacks can shut down public services and disrupt critical infrastructure, however technical disruptions are not the end goal for the perpetrators, claimsAssistant Professor Hadi Ghanbari, lead author of the study.

‘NoName057(16) and other such groups actively aim to undermine public trust in governments, institutions, and countries seen as hostile to Russian interests,’ says Ghanbari. ‘It’s easy to focus on the financial costs, but the more hidden risk is if people lose confidence in large organisations or government services, then the next step is for them to ask what’s the point of having them.’

Since January 7, 2025, NoName057(16) has launched 23 rounds of DDoS attacks against Finnish targets, affecting 129 public and private organisations. The nation has seen a notable uptick in attacks since it became a NATO member in 2023. Targets include the Parliament of Finland and other governmental institutions, numerous municipalities, banks and financial institutions and critical infrastructure service providers. 

Targets may be ‘playing into the hands’ of hackers

The research reveals a new class of ‘hybrid’ warfare that occupies the grey area between hacktivism, state sponsored cyber warfare and cyber-criminality. The group recruits volunteers through Telegram, yet offers payment for members, and evidence from the dark web indicates that cryptocurrency-based rewards of up to USD$1,200 are given for successful attacks. 

‘They claim to be hacktivists but they have an incentive system more common for cyber criminals. They also collaborate and form alliances with other hacker groups, at least one of whom is linked to the Russian cyber army. Essentially, they have gamified their operating model,’ says Ghanbari. ‘This is something new, we haven’t seen this hybrid model before.’

Groups like NoName should not be understood as ordinary hackers or even conventional hacktivists, urges Ghanbari, but as hybrid threat actors who function strategically to wage geopolitical and psychological warfare. He urges that trying to downplay the nature or extent of such attacks to the public, targeted organisations may inadvertently support the hackers’ objectives. 

‘The point is to escalate the psychological cost of their actions. It’s a complex game. Companies and governments can play into the hackers’ hands if they’re not transparent,’ he warns. 

The research suggests that in the case of a reputational or psychological attack, cybersecurity experts should work closely with public relations and communications experts to counteract the effects of propaganda or psychological intimidation. 

Pro-Russian hackers active in Iran/US war

The findings resonate beyond NATO and the EU, with NoName057(16)’s attacks on Israeli infrastructure providing a recent example. ‘Nations who have come out in support of the US are getting more DDoS attacks than anyone else,’ says Ghanbari. ‘Anyone considered an ‘enemy of Russia’, which includes those nations who are even discussing joining NATO, have been attacked.’

From a societal standpoint, these disruptions can block access to essential services for millions of citizens. Yet, the costs of cyberattacks for citizens and users rarely receive the attention they deserve. ‘Not only does it undermine their basic rights, it also undermines the ideological system that underpins them,’ says Ghanbari.

The full study The blurring lines of hacktivism and crowdsourced cyber warfare: How NoName057(16) weaponises distributed denial of service attacks is available online as an open access resource for the 

Contact: 
Assistant Professor Hadi Ghanbari
Aalto University School of Business
hadi.ghanbari@aalto.fi

DOI: