Threat reportThreat IntelligenceTL-2026-3963
Evolution of Hacktivism in Hybrid Warfare: NoName057(16), Killnet and Handala Hack Tactics and Real-World Impact
Evolution of Hacktivism in Hybrid Warfare (TL-2026-3963), also tracked as DDoSia Project, is a medium-severity tracked intrusion set, first published 2026-10-20. It is attributed to NoName057(16) (Russia, Iran) with medium confidence, affects Various Public-facing government, financial, energy, water, maps to 9 MITRE ATT&CK techniques (T1078, T1087, T1485), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 3NoName057(16)
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3963
- Threat ID
- TL-2026-3963
- Also known as
- DDoSia Project, Operation Eastwood (law-enforcement action against NoName057(16))
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- NoName057(16), Killnet, VOID MANTICORE - G1055
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia, Iran
- Motivation
- HACKTIVISM
- Target sectors
- government administration, military, energy, water, finance, transport, health, municipal-utilities, medical-devices
- Target regions
- ukraine, germany, united kingdom, spain, Europe, North America, israel
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Evolution of Hacktivism in Hybrid Warfare
Malware and tooling: Dosia, telegram, DDoSia
How Evolution of Hacktivism in Hybrid Warfare works
Flashpoint reports that pro-Russian hacktivist collectives NoName057(16) and Killnet and the pro-Iranian Handala Hack operate as a high-visibility arm of hybrid warfare that aligns with state geopolitical interests. Tactics include gamified DDoS (DDoSia Project), defacement, data breaches, doxxing, wipers, extortion and CCTV hijacking against government, military, energy, water, finance and transport targets in Ukraine and 30+ nations.
Flashpoint's 26 August 2026 analysis describes hacktivism as a disciplined component of hybrid warfare in which groups mirror state messaging and geopolitical priorities. Pro-Russian collectives NoName057(16) and Killnet focus primarily on Ukraine and secondarily on more than 30 nations, with Germany, the United Kingdom and Spain prioritized, plus other EU/NATO members and North America. Reported tactics are DDoS, website defacement, data breaches, doxxing, physical sticker campaigns, CCTV system hijacking, wiper and extortion claims, and media self-promotion. Claimed targets include government sites, banking and financial markets, energy, water and power utilities, public transportation, Ukrainian military databases (General Staff, enlistment offices), medical and morgue databases, and municipal and regional administrative systems. Flashpoint notes that media visibility is treated as success independent of verified technical impact, and that propaganda channels publish near-identical translated content in six languages within minutes to hours, reusing identical SHA1 hashes on image files.
NoName057(16) crowdsources its DDoS through the DDoSia Project, a gamified, community-based 'patriotic online game' in which volunteers run attack software on their own devices and earn ranks, badges, leaderboard standing and cryptocurrency payments. Public reporting on Europol/Eurojust Operation Eastwood (14-17 July 2025) describes disruption of over 100 servers across 19 countries, two arrests, seven arrest warrants, 24 house searches and notification of over 1,000 supporters, with ENISA, Shadowserver and abuse.ch giving technical support. Killnet began in October 2021 as a DDoS-for-hire offering, became a pro-Russian hacktivist brand after February 2022, coordinates via Telegram, and its founder Killmilk reportedly stepped back in July 2022 in favor of Blackside.
Handala Hack (aliases Void Manticore, COBALT MYSTIQUE, Storm-0842, Storm-1084, Banished Kitten) emerged in late 2023 and is assessed by Palo Alto Unit 42 and others as a front for Iran's Ministry of Intelligence and Security (MOIS). Unit 42 describes exploitation of identity via phishing and of administrative access via Microsoft Intune. On 11 March 2026 Handala claimed a mass wipe against Stryker Corporation (reported as 200,000+ devices in 79 countries) by abusing Intune; CISA issued hardening guidance on 18 March 2026 and the US Justice Department/FBI seized four Handala-linked domains. The Flashpoint source states no CVEs, CVSS scores or technical IOCs; the IOCs below are taken from the cited secondary reporting. Defender priorities are DDoS resilience (CDN/scrubbing, rate limiting, geo and behavioral filtering), hardening of MDM/identity platforms against wipe abuse, and monitoring of hacktivist claims against exposed CCTV and OT-adjacent assets.
MITRE ATT&CK techniques used in TL-2026-3963
Initial Access
T1078 Valid Accounts; T1566 Phishing
Discovery
Impact
T1485 Data Destruction; T1491.002 External Defacement; T1529 System Shutdown/Reboot; T1561 Disk Wipe; T1657 Financial Theft
Resource Development
Affected products and versions in Evolution of Hacktivism in Hybrid Warfare
- Various — Public-facing government, financial, energy, water, transportation and municipal web services
Vulnerable versions: Services lacking DDoS mitigation - Microsoft — Intune (MDM abuse via compromised admin credentials)
Vulnerable versions: Tenants without MFA/multi-admin approval for wipe actions - Various — Internet-exposed CCTV/IP camera systems
Vulnerable versions: Unspecified
Remediation for Evolution of Hacktivism in Hybrid Warfare
Immediate actions
- Enable DDoS mitigation (CDN/scrubbing, rate limiting, WAF bot controls) on public government, finance and utility web properties
- Require phishing-resistant MFA and multi-admin approval for device wipe and other high-impact actions in Microsoft Intune and other MDM platforms
- Block the seized/linked Handala domains at DNS and proxy layers and alert on access to them
- Remove internet exposure of CCTV/IP camera management interfaces and change default credentials
Workarounds
- Pre-arrange upstream ISP/CDN emergency DDoS escalation paths
- Geo/ASN rate limiting during declared campaign windows where business impact allows
Longer-term hardening
- Reduce standing administrative privileges and enforce just-in-time access for identity and endpoint-management admins
- Maintain offline, immutable backups and rehearse recovery from mass-wipe scenarios
- Monitor Telegram and leak-site claims for targeting of your sector and validate claims before public response
- Participate in sector ISAC sharing for DDoS campaign targeting lists
Timeline of Evolution of Hacktivism in Hybrid Warfare
- Killnet formed in October 2021, initially offering DDoS-for-hire services before becoming a pro-Russian hacktivist brand (day approximate; month per public profiles).
- Killnet founder Killmilk reportedly left the group in July 2022, with a hacker using the name Blackside as new leader (day approximate).
- Handala Hack emerges in late 2023 as a pro-Palestinian/pro-Iranian persona, later assessed as a MOIS front (day approximate).
- Europol/Eurojust Operation Eastwood begins (14-17 July 2025): 100+ NoName057(16) servers disrupted across 19 countries, two arrests, seven warrants, 24 house searches and 1,000+ supporters notified.
- Israel's National Cyber Directorate issues a warning on Handala activity (per Unit 42).
- Handala claims a mass wipe of Stryker devices (200,000+ across 79 countries reported) via abuse of Microsoft Intune and Stryker's Active Directory, posting evidence on handala-hack.to.
- CISA urges hardening of endpoint-management systems, phishing-resistant MFA on privileged accounts and multi-admin approval for device wipes.
- US DOJ/FBI seize four MOIS-linked domains (Justicehomeland.org, Handala-Hack.to, Karmabelow80.org, Handala-Redwanted.to); Handala quickly stands up replacement sites.
- Flashpoint publishes analysis of NoName057, Killnet and Handala Hack as state-aligned hybrid-warfare actors targeting Ukraine and 30+ nations, prioritizing Germany, the UK and Spain.
Sources cited for Evolution of Hacktivism in Hybrid Warfare
- The Evolution of Hacktivism in Hybrid Warfare: Modern Tactics and Real-World Impact (Flashpoint)
- Handala Hack wiper attacks (Palo Alto Networks Unit 42)
- Operation Eastwood disrupted operations of pro-Russian hacker group NoName057(16) (Security Affairs)
- FBI seizes pro-Iranian hacking group's websites after destructive Stryker hack (TechCrunch)
- FBI Seizes Iranian Online Leak Sites After Stryker Hack (BankInfoSecurity)
- FBI shuts down hacktivist websites following Stryker cyberattack (Healthcare IT News)
- Killnet - Flashpoint profile
- Killnet: from cybercriminals to cyber partisans (CSA Singapore)
- Killnet, Killmilk (The Record)
- Europol cripples pro-Russia cybercrime network (Computing)
Detection coverage for TL-2026-3963
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3963 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3963
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.