One Hacktivist Claim, Many Posts: Which Unit to Count

In January 2026 one NoName057(16) claim reached our collection three times. An English copy came first, a Russian copy followed 30 minutes later, and a Spanish copy arrived about five and a half hours after the first.

The three texts differ because they are translations, yet they list the same six targets in one country, and two of those entries carry the claimant’s own geo-block remark.

Three posts, three distinct texts, one claim event: a count of posts scores this as three and a count of events as one. Which number reaches your threat briefing decides whether your country looks three times as targeted as it was.

This companion to our main investigation of hacktivist DDoS claims asks how a claim turns into posts. It also asks which unit to count when a group names your country or sector. Our answer is the claim event, because posts mostly record which mirrors we collect.

Five Rungs from a Post to a Claimed Target

We rebuilt NoName057(16)’s claims from January to October as a ladder. Each rung removes one source of multiplication. A claim event means the same group, the same set of targets and the same day. Targets are counted as listed entries, which are mentions inside claims and not verified targets.

The second rung is the surprise: removing duplicate text barely moves the count, from 1,107 to 1,090, because a Russian or Spanish mirror is a translation. Text de-duplication is the wrong tool here, and only the event rung removes the multiplier.

Thirty-seven of the 2,920 entries sit in nine events whose lines we could not parse, which is why the last rung uses 2,883.

Why Do Posts per Claim Move So Much?

Across all months NoName057(16) averages 1.92 collected posts per claim event (1,107 posts, 578 events). The average hides a swing. In January to June, with Russian, English and Spanish mirrors all in our collection, it was 2.25 (2.54 in February to April alone). In July and August, with only the English channel, it was 1.10.

The mirrors explain the swing. The English copy comes first in 346 of the 370 events that have more than one copy. A Russian copy follows after a median of about 16 minutes, and a Spanish copy after about eight hours. By 24 hours, 93% of later copies have appeared.

The share of claims seen only once tells the same story. It was 15% of events in January to June, 93% in July and August and 56% in September and October, or 36% (208 of 578) over all months. For every other named group and unattributed channel it is 95% (593 of 626), at 1.07 posts per event, so the multiplier belongs to one group’s mirror network.

Did Claims Fall by Two Thirds, or Did Mirrors?

Between March and July, NoName057(16) claim posts fell from 192 to 64, a drop of 67%, while claim events fell from 74 to 59, a drop of 20%. Both numbers are true, and they answer different questions.

The Russian channel disappears from our collection after June, and the Spanish mirror is near zero in July and August. Our overall channel coverage also fell over the summer, from about 600 to 390 channels. We cannot tell whether those channels stopped, moved or left our collection, so we do not read it as the group stopping.

The event count is the steadier series, because the English channel is present in all ten months and is first in about nine of ten multi-copy events. We do not read the 20% as a change in claim activity, since events are also a lower bound. Real activity may have fallen further and mirror loss may have hidden it. The data cannot separate the two, so the event series is the conservative one to quote.

Which Unit Ranks Your Country?

The unit changes rankings, not only totals. Counting posts, NoName057(16) holds 62% of all 1,774 collected target-claim posts, and counting events it holds 48% of 1,204.

Against the next group, Keymous+, the gap is 5.2 times by posts (1,107 against 212) and 2.9 times by events (578 against 196). NoName057(16) is still the most active claimant in the collected claim stream, but its lead is smaller than post counts suggest.

Country rankings flip too. By posts Italy looks busier than Germany, and by events Germany does. The table shows why: almost half of Germany’s events fall in July and August, when only the English channel was collected.

Germany averages 2.12 posts per event in January to June and 1.14 in July and August, while Italy has no events in those two months at all. A defender whose country is named should therefore count events, not posts. Country labels were right for 17 of 20 checked events, so treat country counts as close, not exact.

Which Keywords Pull in Non-Claims?

Relay is not the only way a count grows. If you build alerts on a group’s name, three other mechanisms add posts that are not claims.

• An alliance tag list of about 30 groups sits in 96 of 2,264 group-name posts (4.2%) and brings in the words keymous and garuda (HD-C019).
• One Indonesian welcome message makes up 448 of 885 hacktivist-keyword posts (50.6%) and 448 of the 480 posts from September and October (HD-C030).
• The word garuda collides with betting: at least 106 of 725 posts (14.6%) are casino bot or advert posts, and 64 (8.8%) were read as hacktivist-related.

The word ddos has its own problem, because most of it is advertising. See our companion study on what DDoS-for-hire ads advertise. Feed-format restatements and news items add a further layer of posts without adding events. Our classification of that layer is the weakest in the independent check, at about half agreement, so we do not count it.

What Changes in a Briefing

Four changes follow from the ladder. Each replaces a number that looks precise with one a reader can interpret.

1. Report claim events, with the date and the number of listed entries. State posts only as the raw count.
2. Never compare post counts across groups. NoName057(16) averages 1.92 posts per event, and the other groups average close to one.
3. Never read a fall in posts as a fall in claims without checking which mirrors you hold. A 67% drop in posts matched a 20% drop in events.
4. Describe each entry as a mention in a claim. In about three in ten parsed entries the claimant itself notes a geo-block, a dead ping or a placeholder page.

If you hold only one channel, count events from that channel and label the series a lower bound. Do not add a Russian or Spanish feed later and compare the totals, because the multiplier changes the day the mirror arrives.

A claim event is a statement by a group about its targets. It is not an outage, and no check in our data shows duration or user impact.

For a security team the useful reading is narrower. It tells you your country or sector was named, how often, and in which weeks, and that is the evidence a briefing can defend.

Cloudflare’s H1 2026 threat report makes a similar choice of unit. After the 28 February strikes on Iran it cites 149 hacktivist DDoS claims against 110 distinct organizations across 16 countries within 72 hours. That counts claims and organizations, not posts. The Hacktivism and DDoS research chapter holds the full claim records, and the Fraud chapter applies the same discipline to repeated offers.

Counting Rules and Limits

Scope. Collected posts from 1 January to 27 October 2026, Telegram-dominated. The group is NoName057(16), which Europol’s headline calls a pro-Russian cybercrime network. Group names are labels in the text, not people.

Limits. Posts per event is a lower bound that moves with collection coverage. Lags are between collected copies, and the first collected copy may not be the first public copy. Event construction rests on an AI reader, and we did not sample whether mirrors were merged correctly or whether a copy after midnight lands in the next day’s event.

Precision. In an independent check, target-claim posts agreed 39 of 40 (97.5%). Overall labels agreed 164 of 199 (82%) pooled and 33 of 48 (69%) on the cleaner holdout, and both samples are stratified, so they are not population estimates. Target counts were right in 20 of 20 events and country in 17 of 20.

A third-party weekly roundup relayed on Telegram tracked our weekly series with a correlation of 0.69 over 27 weeks. That is a method note, not a headline.

Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.

Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.

Brandefense analysts reviewed and approved the findings.