NetSecurity Threat Report: NoName057(16) Pro-Russian Hacktivist Group

NoName057(16) Threat Group Motivation

NoName057 is a pro-Russian threat actor group that has been making headlines recently. The group is believed to be associated with the Russian government, and has been linked to numerous cyberattacks, including targeting government networks, military systems, and corporate networks. This is a politically motivated group and follows the pro-Russian agenda and targets pro-Ukrainian companies and institutions in Ukraine and NATO countries in response to evolving political conditions. This group gained significance after the Russian-Ukrainian war. The primary goal of NoName057(16) is to disrupt websites that are important to nations that have been critical of Russia’s invasion of Ukraine.

Targets of NoName057(16) Group

NoName057 was first spotted in March 2022, and since then, their activities have become more frequent and their targets have become more sophisticated. NoName057(16) exclusively attacks websites with DDoS attacks. In early June, the group targeted Ukrainian news servers. After that, they targeted Ukrainian government, utility, armament, transportation, and postal websites. Attacks began to become more political in mid-June. In Denmark, NoName057(16) disrupted services across the financial sector. Additionally, businesses and organizations in Poland and Lithuania have been attacked by this group. It was observed in January 2023 that NoName057(16) began to target the websites of 2023 Czech presidential candidates. Recently, this group has launched DDoS attacks on the targets across US and Canada.

Attack Methodology: Tactics, Techniques and Procedures

DDoS attacks are the most common method leveraged by this group for achieving disruptions. Though the volumes of DDoS attacks reported have been significantly low compared to other pro-Russian hacktivist groups like KillNet, the NoName057(16) creates a headline by attacking multiple pro-Ukraine entities at the same time. The NoName057(16) group leverages Bobik, a Botnet-as-a-Service, CobaltStrike trojan, and Redline Stealer initial access broker (IAB) service for creating a botnet that will eventually be used for performing the DDoS attacks on the selected targets. The group is also tending to operate and perform cyber attacks active during Russian time zone. In addition, the group also performs the DDOS attacks using a github based DDOSIA tool. The group is observed to leverage Neterra, a Bulgarian telecommunications organization for C2 activities in addition to the No-IP Dynamic DNS services.

Telegram Channel For Public Disclosure of Their Attacks

Founded in March, 2022, their Telegram channel has over 14K followers. The group boasts about the success of their DDoS attacks on the Telegram channel with an average of around 6 posts per day. Group members only report successful DDoS attacks. The actors behind NoName057(16) have managed to remain anonymous, making it even harder to track them down.

How to Prevent NoName057(16) Cyber Attacks

NoName057 is a serious threat to organizations across the globe. It is important to stay vigilant and ensure that your networks are secured. Prevention of NoName057(16) attacks can be achieved in two main ways. One is by implementing DDoS prevention tools that can instantly detect and scrub active DDoS attacks and the other is by deploying effective and sophesticated threat detection and prevention solution like ThreatResponder. ThreatResponder® Platform is an all-in-one cloud-native endpoint threat detection, prevention, response, analytics, intelligence, investigation, and hunting product. Once lightweight agents (“Rovers”) are deployed, you gain situational awareness and immediate threat visibility into hundreds and thousands of endpoints, respond to nation-state and insider threats, and neutralize cyber attacks quickly. ThreatResponder® allows investigators to conduct incident response and computer forensics investigation on a remote endpoint. In addition to these features, ThreatResponder also provides advanced analytics capabilities that help organizations quickly identify and respond to potential threats. The solution is designed to be easy to use, allowing organizations to quickly implement and start using it to prevent cyber attacks.

Want to try our ThreatResponder, cutting-edge Endpoint Detection & Response (EDR), and ThreatResponder FORENSICS, the Swiss knife for forensic investigators in action? Click on the below button to request a free demo of our NetSecurity’s ThreatResponder platform.

Start a Free Demo

Indicators of Compromise:

94d7653ff2f4348ff38ff80098682242ece6c407
e786c3a60e591dec8f4c15571dbb536a44f861c5
c86ae9efcd838d7e0e6d5845908f7d09aa2c09f5
e78ac830ddc7105290af4c1610482a41771d753f
09a3b689a5077bd89331acd157ebe621c8714a89
8f0b4a8c8829a9a944b8417e1609812b2a0ebbbd
717a034becc125e88dbc85de13e8d650bee907ea
ef7b0c626f55e0b13fb1dcf8f6601068b75dc205
b63ce73842e7662f3d48c5b6f60a47e7e2437a11
5880d25a8fbe14fe7e20d2751c2b963c85c7d8aa
78248539792bfad732c57c4eec814531642e72a0
1dfc6f6c35e76239a35bfaf0b5a9ec65f8f50522
2.57.122.82
2.57.122.243
109.107.181.130
77.91.122.69
31.13.195.87
tom56gaz6poh13f28[.]myftp.org
zig35m48zur14nel40[.]myftp.org
05716nnm@proton[.]me
hxxps://t[.]me/noname05716
hxxps://t[.]me/nn05716chat
hxxps://github[.]com/dddosia
dddosia[.]github.io
hxxps://github[.]com/kintechi341

Disclaimer

The page’s content shall be deemed proprietary and privileged information of NETSECURITY CORPORATION. It shall be noted that NETSECURITY CORPORATION copyrights the contents of this page. Any violation/misuse/unauthorized use of this content “as is” or “modified” shall be considered illegal and subjected to articles and provisions that have been stipulated in the General Data Protection Regulation (GDPR) and Personal Data Protection Law (PDPL).