12OCT

ENISA finds most NoName057(16) claims fail

2 min read

10:55UTC

ENISA's threat report analysed 8,257 incidents from 2025 and found only 23.8 per cent of NoName057(16)'s assessed attack claims held up.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Fewer than a quarter of NoName057(16)'s assessed DDoS claims survived ENISA's availability checks.

The European Union Agency for Cybersecurity (ENISA) published its annual threat report on 22 September, analysing 8,257 incidents from calendar 2025⁠¹. Of those, 51.3 per cent were distributed denial-of-service (DDoS) floods, which knock sites offline with junk traffic. ENISA moved to a calendar-year period this edition, so the total does not compare with the previous report.

Public administration took 31.8 per cent of events, and 81.8 per cent of those were ideologically driven DDoS. ENISA's NIS360 study in May had already found hacktivists aiming mostly at public bodies. The pro-Russian group NoName057(16) produced 48 per cent of ideology-driven activity. Only 23.8 per cent of the claims ENISA assessed survived independent checks on whether the target actually went down.

Germany took 26.5 per cent of ransomware claims against EU member states, and manufacturing 25.2 per cent. ENISA's press release puts cybercrime at 36 per cent of events, while the report gives 29.3 per cent⁠²; the figures here come from the report.

Deep Analysis

In plain English

The European Union Agency for Cybersecurity (ENISA) publishes a yearly report on cyber attacks against EU countries. This year it studied 8,257 incidents from 2025. Just over half were denial-of-service attacks, where attackers flood a website with junk traffic until it stops working. Most were aimed at government sites and were driven by politics rather than money. A pro-Russian group called NoName057(16) made almost half of the politically driven attacks. But when ENISA checked whether the targeted sites really went offline, most of the group's boasts did not hold up.

Deep Analysis

Root Causes

DDoSia recruits volunteers who install a client and receive target lists, with participants rewarded in cryptocurrency. The model scales cheaply and lets the organisers claim every target on the list, whether or not it went down.

Public administration websites run on modest hosting budgets without the scrubbing services banks buy. That makes them the easiest targets on which to stage a visible outage, which is why they took 31.8 per cent of events.

NIS2 essential and important entities made up 73 per cent of targets in ENISA's data, so the attacks fall mainly on organisations now bound by EU incident-reporting duties .

What could happen next?

Meaning
Raw hacktivist claim counts overstate impact and should not be cited without independent availability checks.
Consequence
Journalists and officials repeating unverified DDoS claims amplify the influence effect ENISA says the group seeks.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In early 2023 the pro-Russian group Killnet claimed denial-of-service attacks on US hospitals and European governments, and US health-sector warnings followed. Most outages lasted hours, and later analysis found the publicity far outweighed the operational damage.

Counter-parallel: In April and May 2007 denial-of-service floods hit Estonia's banks, media and government for about three weeks after Tallinn moved a Soviet war memorial. That campaign caused real disruption and led NATO to set up its cyber defence centre in Tallinn the next year.

The costs of ideological DDoS fall on public bodies as hours of outage and the price of protection services, not as ransom or data loss. Ransomware carries the larger losses, and Germany drew 26.5 per cent of claims against member states, with manufacturing at 25.2 per cent of claimed deployments.

ENISA counted more than 48,000 new CVEs published in 2025, up 22 per cent, which adds patch workload across the same NIS2-regulated organisations.

Consensus view: ENISA's report finds NoName057(16)'s claims 'generally aligned with intended targeting' by its DDoSia tool, yet only 23.8 per cent passed independent availability checks. ENISA itself suggests some claims served 'an influence objective by inflating perceptions of operational impact', so the group's output is propaganda measured in claims as much as disruption measured in downtime.

Counter-view: Europol's Operation Eastwood in July 2025 dismantled more than 100 NoName057(16) servers and led to arrests in France and Spain, showing law enforcement weighs the group well above its verified hit rate. ENISA's own press release also gives a 36 per cent cybercrime share that its report, at 29.3 per cent, does not support, so the agency's headline figures need the same scrutiny it applies to hacktivists.

Key tension: Whether a DDoS claim that fails independent checks still achieves its aim if the target country's media reports it as an attack.

Sources:ENISA·ENISA

Mentions:ENISA →Germany →European Union →NIS360 →Europol →Estonia →Tallinn →Spain →NATO →France →NoName057(16) →Operation Eastwood →NIS2 →DDoSia →Killnet →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

ENISA· 12 Oct 2026

Read original →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.