# Hacktivism as Hybrid Warfare: NoName057(16), Killnet, and Handala Hack Escalate Coordinated Disruption Campaigns Against NATO/EU Infrastructure

> Pro-Russian hacktivist collectives NoName057(16) and Killnet, alongside the pro-Iranian Handala Hack Team (a Void Manticore/MOIS persona), have shifted from opportunistic defacement/DDoS to disciplined, gamified, state-aligned campaigns. NoName057(16)'s DDoSia Project uses military-style ranks and cryptocurrency (dCoin) rewards to crowdsource DDoS attacks that have disrupted energy, water, transportation, and administrative infrastructure across 30+ NATO/EU nations, while Handala has escalated from hack-and-leak into destructive wiper attacks and physical-threat coordination.

- **Published:** 2026-08-26T00:00:00Z
- **Last reviewed:** 2026-08-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2154
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-noname057-16-ddosia-escalation-tl-2026-2154.webp?v=7f4a6b9c (Threadlinqs threat intel: NoName057(16) DDoSia NATO Escalation: Detection & IOCs (TL-2026-2154) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-2154
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** NoName057(16) (Russia, Iran)
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

Between July 2025 and August 2026, three hacktivist collectives with assessed nation-state alignment intensified operations that Flashpoint and CISA characterize as a component of hybrid warfare rather than opportunistic activism. NoName057(16), assessed to have originated as a covert project of Russia's Centre for the Study and Network Monitoring of the Youth Environment (CISM) operating on behalf of the Kremlin, runs the DDoSia Project: a Go-based, volunteer-operated DDoS client distributed via a Telegram bot (t.me/DDosiabot) that assigns each participant a User Hash and UUID4 Client ID, retrieves AES-GCM-encrypted target lists from a two-tier, rapidly rotated C2 infrastructure (Tier-1 nodes averaging a 9-day lifespan; Tier-2 nodes ACL-restricted to Tier-1 only), and rewards volunteers with an internal currency (dCoin, convertible via TON cryptocurrency to cash) scaled to attack-traffic leaderboards and military-style ranks. Observed DDoSia traffic in 2025-2026 was dominated by nginx_loris application-layer floods (31.5%), SYN floods (17.6%), ACK floods (16.1%), and HTTP GET floods (15.4%), averaging roughly 50 unique daily targets across government, financial, transportation, energy, telecommunications, and NATO-affiliated organizations in 30+ countries. NoName057(16) and allied group ServerKillers ran sustained campaigns against Spain (January-February 2026, ~6,000 entries across 143 domains; a further Spain-focused wave February 16-23, 2026, logged 8,044 attacks across 167 domains and 180 IPs, with Spain absorbing 49.4% of activity) and against Italy during the Milano Cortina Winter Olympics (February 2026). NoName057(16)-affiliated actor PalachPro breached Ukrainian General Staff and territorial recruitment center (TCC) databases, exposing military casualty figures, personal data of soldiers, and next-of-kin contact information. On July 23, 2026, DDoSia participants claimed access to an Ontario water system; independent analysts classified this as an unverified OT-access claim rather than confirmed disruption. International law enforcement responded with Operation Eastwood (July 14-17, 2025), an Europol/Eurojust-coordinated action across the Czech Republic, Finland, France, Germany, Italy, Lithuania, the Netherlands, Poland, Spain, Sweden, Switzerland, and the US that seized 100+ servers, made two arrests (France, Spain), issued seven arrest warrants (six Germany, one Spain), and conducted 24 house searches; NoName057(16) responded by declaring a coordinated retaliation campaign against Spain (#FuckGuardiaCivil). CISA subsequently published advisory AA25-343A (December 9, 2025) formally mapping pro-Russia hacktivist TTPs to MITRE ATT&CK. Killnet, the pro-Russian collective led by KillMilk that dominated the space 2022-2024 with claimed attacks on NATO Special Operations Headquarters, Strategic Airlift Capability, and NATO's restricted communications network, has since fragmented; its Telegram infrastructure was sold off and its remaining influence persists mainly through successor/splinter entities (e.g., Cyber Army Russia Reborn, associated with the Z-Pentest OT-targeting brand) rather than a unified Killnet operation. In parallel, the pro-Iranian Handala Hack Team - publicly a pro-Palestinian hacktivist persona but attributed by the US DOJ and researchers to Void Manticore (TAG-145 / Red Sandstorm / Banished Kitten), a cluster tied to Iran's Ministry of Intelligence and Security (MOIS) Counterterrorism Division - escalated from hack-and-leak operations into destructive attacks. Handala's intrusion chain uses phishing emails carrying malicious PDF attachments disguised as system-recovery utilities and NSIS-packaged/AutoIT (.a3x) droppers such as F5UPDATER.EXE, escalates privileges via a Bring-Your-Own-Vulnerable-Driver technique (ListOpenedFileDrv_32.sys loaded through OpenFileFinder.dll), performs discovery via native Windows commands, and communicates over hardcoded Telegram bot tokens/channel IDs before executing a disk-wipe payload (4,096-byte overwrites on Windows; Linux variants using parted/mkfs to reformat drives as XFS). Confirmed/claimed 2026 Handala operations include the March 1 launch of the "RedWanted" doxxing site naming Israel supporters, the March 6 claimed theft of 851GB from the Sanzer Hasidic Jewish community, the March 11-12 wiper attack against medical device manufacturer Stryker Corporation that triggered remote-wipe commands against 80,000-200,000 Intune/MDM-managed devices across 79 countries, the March 27 breach and publication of 300+ emails from then-FBI Director Kash Patel's personal account, and a June 11-12 claimed breach of California Water Service (Cal Water) affecting Bakersfield, Visalia, and Chico customers - independent analysis confirmed exposure of a billing database and an RTKBase NTRIP GPS-correction server (no OT/ICS compromise, no service disruption), with Handala stating it retaliated for US strikes on Iranian water infrastructure and asserting - without demonstrating - the ability to cause disruption. Handala's parent ecosystem also runs Telegram-based proxy-recruitment and psychological-operations infrastructure (VIPEmployment bots soliciting attacks/espionage, MOISIRAN publishing surveillance footage of Israeli personnel, and the Handala Popular Resistance Front (HPRF) claiming vehicle-arson attacks against Israeli law enforcement), extending the campaign beyond cyber into coordinated physical and influence operations. Flashpoint's August 26, 2026 report frames this convergence - gamified crowdsourcing, real-world critical-infrastructure disruption, and physical/psychological operations run by state-aligned hacktivist brands - as a maturing hybrid-warfare capability rather than isolated activist activity.

## MITRE ATT&CK

- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1583.005 Acquire Infrastructure: Botnet
- T1583.006 Acquire Infrastructure: Web Services
- T1071.001 Application Layer Protocol: Web Protocols
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1008 Fallback Channels
- T1498.001 Network Denial of Service: Direct Network Flood
- T1499.003 Endpoint Denial of Service: Application Exhaustion Flood
- T1491.002 Defacement: External Defacement
- T1561.001 Disk Wipe: Disk Content Wipe
- T1566.001 Phishing: Spearphishing Attachment
- T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**DDoSia Application-Layer Flood Signature (nginx_loris / SYN / ACK / HTTP GET) Against Protected Web Assets** (`TL-2026-2154-SPL-003`)

Detects the DDoSia Project's dominant 2025-2026 attack-traffic mix -- nginx_loris application-layer floods, SYN floods, ACK floods, and HTTP GET floods -- driven by NoName057(16)'s crowdsourced volunteer botnet, at the web/edge tier protecting government and critical-infrastructure assets.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1498.001, T1499.003, T1583.005, T1071.001
- **Data sources:** web_access_logs, firewall, waf, azure_front_door
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype="access_combined" OR sourcetype="cisco:asa" OR sourcetype="pan:traffic"
| eval attack_pattern=case(
    match(_raw,"(?i)slowloris") OR match(http_user_agent,"(?i)nginx_loris"), "nginx_loris",
    match(_raw,"SYN_FLOOD") OR (tcp_flags="S" AND syn_only=1), "syn_flood",
    match(_raw,"ACK_FLOOD"), "ack_flood",
    method="GET" AND status=200, "get_flood",
    1=0, "none")
| where attack_pattern!="none"
| bucket _time span=1m
| stats count as req_count dc(src_ip) as unique_sources by _time, dest, attack_pattern
| where req_count > 500 AND unique_sources > 50
```

### Microsoft KQL

```kql
AzureDiagnostics
| where Category == "ApplicationGatewayAccessLog" or Category == "FrontDoorAccessLog"
| where TimeGenerated > ago(1h)
| extend attack_pattern = case(
    userAgent_s has "nginx_loris" or requestUri_s has "slowloris", "nginx_loris",
    httpMethod_s == "GET" and httpStatusCode_d == 200, "get_flood",
    "other")
| where attack_pattern != "other"
| summarize RequestCount = count(), UniqueSources = dcount(clientIP_s) by bin(TimeGenerated, 1m), attack_pattern, host_s
| where RequestCount > 500 and UniqueSources > 50
```

### Sigma

```yaml
title: DDoSia Crowdsourced Application-Layer Flood (nginx_loris / SYN / ACK / GET)
id: 1f6b3d8a-4c2e-4b9f-a1d6-7e3c9b2f5a8d
status: experimental
description: Detects a burst of high-volume, high-source-diversity nginx_loris, SYN, ACK, or HTTP GET flood traffic against a public-facing web asset, matching NoName057(16)'s DDoSia Project attack-traffic composition (nginx_loris 31.5%, SYN 17.6%, ACK 16.1%, GET 15.4% of observed 2025-2026 traffic).
references:
    - https://www.recordedfuture.com/research/anatomy-of-ddosia
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-26
tags:
    - attack.impact
    - attack.t1498.001
    - attack.t1499.003
    - attack.resource-development
    - attack.t1583.005
    - attack.tool.ddosia
logsource:
    category: firewall
    product: network
detection:
    selection:
        request_method: 'GET'
        status_code: 200
    timeframe: 1m
    condition: selection | count() by dst_ip > 500
falsepositives:
    - Legitimate flash-crowd traffic during a publicized event (e.g. ticket release) -- cross-check source ASN diversity and known DDoSia Tier-1/Tier-2 IP ranges before alerting as malicious
level: high
```

**Known false positives:**

- Legitimate flash-crowd traffic during a publicized event; cross-check source ASN diversity against known DDoSia infrastructure before escalating

**Tuning notes:** Tune req_count/unique_sources thresholds to the asset's normal peak traffic baseline; enrich source IPs against a DDoSia Tier-1/Tier-2 C2 IP feed (e.g. 38.180.143.83) to raise confidence from 'possible flood' to 'confirmed DDoSia'.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake System-Recovery PDF Lure Opens NSIS Installer Chain (Handala Initial Access) (locked: unlock with TL Creds)
- Post-BYOVD Discovery Sweep Following Vulnerable Driver Load (Handala) (locked: unlock with TL Creds)
- Handala Telegram C2 Beacon Followed by Disk-Wipe Payload Execution (Windows Overwrite / Linux parted-mkfs.xfs) (locked: unlock with TL Creds)
- Mail-Client-Spawned NSIS/AutoIT Dropper Process Chain (Handala F5UPDATER Pattern) (locked: unlock with TL Creds)
- [indicator] Loaded Outside Vendor Baseline (LOLDriver / BYOVD) (locked: unlock with TL Creds)
- External Website Defacement Content Change Combined with DDoSia Bot Registration Traffic (t.me/DDosiabot) (locked: unlock with TL Creds)
- Handala Phishing-to-AutoIT Dropper Execution Chain (F5UPDATER.EXE / .a3x) (locked: unlock with TL Creds)
- BYOVD Privilege Escalation via [indicator] / [indicator] (Handala Wiper Chain) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `38.180.143[.]83`
- Domain: `handala[.]red`
- Domain: `handala-hack[.]ps`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Evolution of Hacktivism: Hybrid Warfare, Modern Tactics, and Real-World Impact](https://flashpoint.io/blog/evolution-hacktivism-hybrid-warfare-modern-tactics-real-world-impact/)
- [Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure (AA25-343A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a)
- [Global operation targets NoName057(16) pro-Russian cybercrime network](https://www.europol.europa.eu/media-press/newsroom/news/global-operation-targets-noname05716-pro-russian-cybercrime-network)
- [Inside DDoSia: NoName057(16)'s Pro-Russian DDoS Campaign Infrastructure](https://www.recordedfuture.com/research/anatomy-of-ddosia)
- [How NoName057(16) Uses DDoSia to Attack NATO Targets](https://www.picussecurity.com/resource/blog/how-noname05716-uses-ddosia-to-attack-nato-targets)
- [Handala Threat Group Tactics, Targets, and Attack Timeline](https://www.picussecurity.com/resource/blog/handala-threat-group-tactics-targets-and-attack-timeline)
- [Iran Expands Handala Brand to Physical Threats](https://www.recordedfuture.com/research/iran-handala-physical-threats)
- [Iran-Linked Handala Breached a California Water Utility. It Could Have Done Worse, and It Knows That.](https://securityaffairs.com/193565/uncategorized/iran-linked-handala-breached-a-california-water-utility-it-could-have-done-worse-and-it-knows-that.html)
- [Stryker hack: pro-Iran hacktivist group Handala says it is behind attack](https://techcrunch.com/2026/03/11/stryker-hack-pro-iran-hacktivist-group-handala-says-it-is-behind-attack)
- [6 Things To Know About Handala — Tehran's Hackers Making Front Page News](https://www.fdd.org/analysis/2026/04/01/6-things-to-know-about-handala-tehrans-hackers-making-front-page-news/)
- [Cyber Intel Brief: Handala Claims Breach of California Water Service](https://www.dataminr.com/resources/intel-brief/cyber-intel-brief-handala-claims-breach-of-california-water-service/)
- [NoName057(16) and DDoSia Project Analysis: Russia's Most Persistent Hacktivist Operation](https://socradar.io/blog/noname05716-and-ddosia-project-analysis-russia/)
- [NoName pro-Russian hackers arrested in Spain, group vows retaliation](https://cybernews.com/news/noname-pro-russian-hackers-arrested-in-spain-group-vows-retaliation/)
- [NoName057/NoName05716: DDoS Threat Intel & Defense Guide](https://www.bitsight.com/blog/noname057-16-ddos-threat-intelligence)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2154