Anatomy of DDoSia: NoName057(16)'s DDoS Infrastructure and Targeting

Recorded Future's Insikt Group details NoName057(16)'s DDoSia campaign (July 2024–July 2025), attributing a sustained, volunteer-driven pro‑Russian DDoS operation that targeted ~3,776 unique hosts—predominantly government and public-sector organizations in Europe. The report documents a resilient multi-tiered C2 architecture with rapidly rotated Tier 1 servers and ACL‑protected Tier 2 backends, describes the DDoSia client registration and encrypted target-fetch flow, enumerates attack methods (SYN/ACK floods, HTTP/HTTP2, slow‑loris variants), provides temporal and geographic targeting analysis, lists numerous C2 IP IoCs, and offers mitigations and operational recommendations for defenders.