# Evolution of Hacktivism in Hybrid Warfare: NoName057(16), Killnet and Handala Hack Tactics and Real-World Impact

> Flashpoint reports that pro-Russian hacktivist collectives NoName057(16) and Killnet and the pro-Iranian Handala Hack operate as a high-visibility arm of hybrid warfare that aligns with state geopolitical interests. Tactics include gamified DDoS (DDoSia Project), defacement, data breaches, doxxing, wipers, extortion and CCTV hijacking against government, military, energy, water, finance and transport targets in Ukraine and 30+ nations.

- **Published:** 2026-10-20T14:20:21Z
- **Last reviewed:** 2026-10-20T14:20:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3963
- **ID:** TL-2026-3963
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** NoName057(16) (Russia, Iran)
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Flashpoint's 26 August 2026 analysis describes hacktivism as a disciplined component of hybrid warfare in which groups mirror state messaging and geopolitical priorities. Pro-Russian collectives NoName057(16) and Killnet focus primarily on Ukraine and secondarily on more than 30 nations, with Germany, the United Kingdom and Spain prioritized, plus other EU/NATO members and North America. Reported tactics are DDoS, website defacement, data breaches, doxxing, physical sticker campaigns, CCTV system hijacking, wiper and extortion claims, and media self-promotion. Claimed targets include government sites, banking and financial markets, energy, water and power utilities, public transportation, Ukrainian military databases (General Staff, enlistment offices), medical and morgue databases, and municipal and regional administrative systems. Flashpoint notes that media visibility is treated as success independent of verified technical impact, and that propaganda channels publish near-identical translated content in six languages within minutes to hours, reusing identical SHA1 hashes on image files.

NoName057(16) crowdsources its DDoS through the DDoSia Project, a gamified, community-based 'patriotic online game' in which volunteers run attack software on their own devices and earn ranks, badges, leaderboard standing and cryptocurrency payments. Public reporting on Europol/Eurojust Operation Eastwood (14-17 July 2025) describes disruption of over 100 servers across 19 countries, two arrests, seven arrest warrants, 24 house searches and notification of over 1,000 supporters, with ENISA, Shadowserver and abuse.ch giving technical support. Killnet began in October 2021 as a DDoS-for-hire offering, became a pro-Russian hacktivist brand after February 2022, coordinates via Telegram, and its founder Killmilk reportedly stepped back in July 2022 in favor of Blackside.

Handala Hack (aliases Void Manticore, COBALT MYSTIQUE, Storm-0842, Storm-1084, Banished Kitten) emerged in late 2023 and is assessed by Palo Alto Unit 42 and others as a front for Iran's Ministry of Intelligence and Security (MOIS). Unit 42 describes exploitation of identity via phishing and of administrative access via Microsoft Intune. On 11 March 2026 Handala claimed a mass wipe against Stryker Corporation (reported as 200,000+ devices in 79 countries) by abusing Intune; CISA issued hardening guidance on 18 March 2026 and the US Justice Department/FBI seized four Handala-linked domains. The Flashpoint source states no CVEs, CVSS scores or technical IOCs; the IOCs below are taken from the cited secondary reporting. Defender priorities are DDoS resilience (CDN/scrubbing, rate limiting, geo and behavioral filtering), hardening of MDM/identity platforms against wipe abuse, and monitoring of hacktivist claims against exposed CCTV and OT-adjacent assets.

## MITRE ATT&CK

- T1491.002 External Defacement
- T1485 Data Destruction
- T1561 Disk Wipe
- T1529 System Shutdown/Reboot
- T1657 Financial Theft
- T1566 Phishing
- T1078 Valid Accounts
- T1087 Account Discovery
- T1584.005 Botnet

## Sources

- [The Evolution of Hacktivism in Hybrid Warfare: Modern Tactics and Real-World Impact (Flashpoint)](https://flashpoint.io/blog/evolution-hacktivism-hybrid-warfare-modern-tactics-real-world-impact/)
- [Handala Hack wiper attacks (Palo Alto Networks Unit 42)](https://unit42.paloaltonetworks.com/handala-hack-wiper-attacks/)
- [Operation Eastwood disrupted operations of pro-Russian hacker group NoName057(16) (Security Affairs)](https://securityaffairs.com/180027/cyber-crime/operation-eastwood-disrupted-operations-of-pro-russian-hacker-group-noname05716.html)
- [FBI seizes pro-Iranian hacking group's websites after destructive Stryker hack (TechCrunch)](https://techcrunch.com/2026/03/19/fbi-seizes-pro-iranian-hacking-groups-websites-after-destructive-stryker-hack/)
- [FBI Seizes Iranian Online Leak Sites After Stryker Hack (BankInfoSecurity)](https://www.bankinfosecurity.com/fbi-seizes-iranian-online-leak-sites-after-stryker-hack-a-31108)
- [FBI shuts down hacktivist websites following Stryker cyberattack (Healthcare IT News)](https://www.healthcareitnews.com/news/fbi-shuts-down-hacktivist-websites-following-stryker-cyberattack)
- [Killnet - Flashpoint profile](https://www.flashpoint.io/blog/killnet)
- [Killnet: from cybercriminals to cyber partisans (CSA Singapore)](https://www.csa.gov.sg/resources/publications/killnet---from-cybercriminals-to-cyber-partisans)
- [Killnet, Killmilk (The Record)](https://therecord.media/killnet-cybercrime-group-russia-kremlin-hacking-company)
- [Europol cripples pro-Russia cybercrime network (Computing)](https://www.computing.co.uk/news/2025/security/europol-cripples-pro-russia-cybercrime-network)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3963