DDoSia
DDoSia is a proprietary distributed denial-of-service (DDoS) attack tool/platform operated by the pro-Russian hacktivist group NoName057(16), active since at least early/March 2022. Multiple sources in the provided content describe it as a homegrown, volunteer-powered and crowdsourced DDoS platform that allows individuals with minimal technical skill to participate in coordinated attacks by contributing computing resources. The platform is coordinated primarily through Telegram, where target lists are shared or updated frequently, leaderboards are published, and top participants may receive cryptocurrency payments, monetary rewards, or community recognition. The content also states that DDoSia has been distributed via GitHub and other code-hosting platforms.
The malware/framework has been used extensively in coordinated campaigns against government and private-sector entities, especially in NATO member states and other European countries viewed as hostile to Russian geopolitical interests, as well as Ukraine and other international targets. Reported victim sectors include government agencies, financial institutions, public railways, ports, transportation networks, water utilities, defense-related entities, tourism/travel, sports/Olympic organizations, and other critical infrastructure. Specific campaign reporting in the content ties DDoSia-enabled operations to attacks against targets in Italy, Germany, the United Kingdom, Spain, Denmark, Ukraine, Greenland, Japan, Austria, Finland, and broader international/commercial domains.
Observed attack methods associated with DDoSia in the provided content include HTTP GET floods, HTTP POST floods, HTTP/2 attacks, HTTP/1.1 attacks, HTTP/3 activity, TCP SYN floods, TCP ACK floods, TCP SYN-ACK floods, UDP floods, ICMP/PING floods, nginx_loris/slow-connection attacks, slowloris-style resource exhaustion, and TCP floods against ports including 80, 443, 2222, and 8080. Port 443/HTTPS is repeatedly described as the most targeted service in multiple campaigns. One source in the content also states that DDoSia supports HTTP, HTTPS, and HTTP2 floods.
Technical analysis in the content focuses on the Windows DDoSia client. It requires a client ID generated through a dedicated Telegram bot and stored in client_id.txt alongside the executable. After authentication, the client downloads an encrypted target list from its server, decrypts it locally, and then launches attack threads. Dynamic analysis cited in the content found that the target list exists briefly in cleartext in process memory before being consumed and later becomes mangled during runtime. The analysis identified two WSAStartup calls, with the second occurring after target retrieval/decryption and before the attack phase, making it useful for memory extraction. The content references tooling created to dump and recover targets from memory and provides two Windows sample SHA-256 hashes: 726c2c2b35cb1adbe59039193030f23e552a28226ecf0b175ec5eba9dbcd336e (d_windows_amd64.exe, dated 2023/04/19) and 1b53443ebaabafd6f511d4cf7cb85ddf9fa32540c5dd5621f04a3c5eefa663a9 (d_win_x64.exe, dated 2023/11/09).
The provided content also includes high-confidence attribution reporting that NoName057(16) used DDoSia as its primary DDoS capability and that the Center for the Study and Network Monitoring of the Youth Environment (CISM), described in indictments/advisories as established on behalf of the Kremlin, allegedly developed/customized the tool, funded supporting infrastructure, administered Telegram channels, and selected targets. Overall, the content consistently characterizes DDoSia as the central malware/tooling component enabling NoName057(16)’s coordinated, geopolitically aligned DDoS campaigns.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group primarily conducted DDoS cyberattacks using their own proprietary DDoS tool, DDoSia, which relied on network infrastructure around the world created by employees of CISM.
“Noname057(16) developed a project—malicious software called Ddosia”
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Stealth
1 techniqueAs already mentioned on Avast blogspot, the target list is encrypted and retrieved after the authentication process. However, performing DDoS attacks requires a decryption routine to make targets in cleartext and forward them to a proper procedure.
Command and Control
2 techniquesIf everything has been done properly, it should be possible to observe that authentication process will be done correctly and the client is going to download targets from its server.
"target list updates distributed multiple times per day through Telegram channels"; "Centralized target lists updated multiple times daily via Telegram distribution"
Impact
6 techniquesthis assessment finds that disruptive intrusions, criminal fraud at scale and politically motivated distributed denial-of-service (DDoS) and hack-and-leak operations are highly likely.
NoName recruited volunteers from around the world to download DDoSia and used their computers to launch DDoS attacks on the victims that NoName leaders selected.
The primary vectors include HTTP/HTTPS/HTTP2 floods; TCP floods on port 80, 443, 2222, 8080; and slowloris-style resource exhaustion attacks.
The dominant use of HTTP GET floods (52.3%) combined with HTTP POST floods (30.1%) demonstrates a near-exclusive application-layer (L7) preference — together comprising 82.4% of all attack methods.
"Most common methods this week: GET: 2,375 ... POST: 1,172" / "Top port: 443 (HTTPS)"
"Attack Types Distribution: GET Flood ... POST Flood ... The elevated POST flood share ... reflects the high proportion of form-based targets..."
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A DDoS platform associated with NoName057(16) that was identified as a key tool used in the attack campaigns targeting Italian infrastructure during the Milano Cortina 2026 Winter Games period.
A homegrown DDoS platform used to conduct attacks against Italian domains, using HTTP/HTTPS/HTTP2 floods, TCP floods on ports 80, 443, 2222, 8080, and slowloris-style resource exhaustion attacks.
Malware/botnet family referenced as part of the malicious ecosystem hosted by the provider.
A volunteer-driven, Telegram-coordinated DDoS framework/botnet used to launch multi-vector attacks (e.g., TCP SYN/ACK floods, HTTP GET/POST floods, UDP floods, ICMP floods, and slow-connection 'nginx_loris' attacks). It uses centralized target lists distributed via Telegram, includes evasion to bypass basic rate-limiting/IP defenses, and gamifies participation via performance reporting/leaderboards and cryptocurrency rewards.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.