In October 2026 a NoName057(16) post opened with news that France would train Ukrainian pilots on Rafale jets. It closed with a boast that French internet infrastructure could not withstand the group’s attacks. In between sat five website entries, each with a link to a reachability-check report. Four of the five carried the group’s own note: closed for geographic reasons, or geo-locked (HD-C001).
That note is the key to the post. A site that refuses foreign visitors looks unreachable to a check run from abroad, flooded or not. We did not open the check reports behind the links, so we cannot say what any of them displayed. What the post records is a check link and the group’s own geo-lock note, set beside a political message.
We read 578 NoName057(16) claim events from 1 January to 27 October 2026. A claim event is one claim, however many posts and languages repeated it.
Our answer is that a claim post is usually a campaign notice: a political header, about five listed sites and, for most entries, a reachability-check link. The stream is regular enough to follow as claims. It does not work as a feed of outages.
What Sits Inside One Claim Post
The typical post lists five entries. The median is five, the mean 5.05 and the range one to fifteen. About three in ten listed entries (895 of 2,883, 31%) were tagged government or municipal by our keyword rules, and the rest are spread across other sectors. Sector labels are rough, so we use only that coarse split.
The header gives the list its meaning. In 216 of 578 events (37%) it ties the list to a news item, and in 149 of those the item concerns military or financial support for Ukraine. The other 362 headers name no trigger.
One February post set four municipal entries in Denmark beside the retirement of Danish F-16 jets (HD-C003). A May post spent most of its length on a song-contest boycott debate before it listed five Austrian public-sector and education entries (HD-C008). None of the records states why those sites were picked, so the link between news item and target remains the claimant’s own framing.
| Feature | Count | Share |
|---|---|---|
| Events whose header names a news trigger | 216 of 578 | 37% |
| Events with a check link for every listed entry | 432 of 578 | 75% |
| Events with a check link for some entries | 138 of 578 | 24% |
| Events with at least one remark by the claimant on an entry | 377 of 578 | 65% |
| Claimed target entries carrying such a remark (of 2,883 parsed entries) | 851 of 2,883 | 29.5% |
| Events whose header uses outage wording | 77 of 578 | 13% |
The Proof Is a Check Taken From Outside
The post supplies a link to a third-party reachability-check service. A link alone does not establish that a check ran or what it returned. Such a report is a snapshot, and it does not show how long a site stayed unreachable, whether any user noticed, or when it recovered.
A link covers every entry in 432 events (75%) and some entries in 138 more (24%). Eight events carry an attachment only.
The claimant also annotates its own proof. In 851 of 2,883 parsed entries (29.5%, about three in ten) it adds a remark: closed for geographic reasons, dead by ping, or closed behind a placeholder page. At least one such remark appears in 377 of the 578 events (65%).
Three records show how the group uses these remarks.
- A January list of five UK entries marks one as closed behind a placeholder and two as dead by ping (HD-C004).
- A March repost of the group’s list in an ally channel says Cyprus tried to hide behind a geo closure. Three of its six entries carry that mark (HD-C005).
- A Spanish-language commentary post, not a claim list, marks two Israeli entries as closed with no check link and mocks the sites for hiding behind blocking pages (HD-C006).
In the Cyprus post a defensive choice by the site operator becomes part of the result. A geographic closure and a placeholder page are both settings the operator controls, and a ping timeout is one probe result at one moment.
We tested the remark count. An independent reader recounted the remarks in 39 sampled claim posts and matched our flags in 34 (87%). Our misses were Spanish translations, and one false match came from the letters “geo” inside a site’s name. The net effect is probably a few points either way.
How Often Does a Header Use Outage Wording?
Seldom, although the list itself carries a claim: every listed entry is presented as attacked or down, whatever the header says.
Our keyword rules find outage wording such as “down” or “disabled” in the headers of 77 of 578 events (13%). Another 201 headers use attack wording without an outage claim, 189 use continuation wording such as “again”, and 207 matched no category. A header can match more than one.
One follow-up post called a public-sector portal in a Central European country a “critical” facility that had been “disabled” the day before. It is an announcement, not a claim list, and it carried no check link of its own, so the previous day’s list was the only artefact (HD-C007).
In another case a post spoke of “disabling” the customer-facing pages of a telecom operator, with four entries (HD-C009). About five hours later a second post claimed user account data from the same operator, with no sample (HD-C010). The check link says nothing about stored data, and the data claim says nothing about reachability.
Country Tours: The Weekly Rhythm
The pattern appears only when claims are laid out by week. NoName057(16) events fall in all 44 ISO weeks of our window, although the first and last weeks are partial. In 22 of the 44 weeks, one country holds 70% or more of the week’s claimed entries, and in 43 it holds at least half. When we shuffled country labels at random across the same events 2,000 times, no run produced more than 2 such weeks.
| Measure | Weeks |
|---|---|
| Leading country holds 70% or more of the week’s entries | 22 |
| Leading country holds 50% or more | 43 |
| Weeks reaching 70% when labels were shuffled (2,000 trials, maximum) | 2 |
Runs of days show the same thing. We counted consecutive days with single-country events for the same country and found 102 runs. Twenty-six were a single event, and 48 reached five or more events. Those 48 hold 459 of the 578 events (79%).
Of the 48 longer runs, 42 began on a Monday, 22 lasted exactly one or two weeks, and 18 lasted five or six days.
Austria ran from 4 to 17 May with 25 events and 135 entries. Germany ran from 6 to 19 July with 25 events and 113 entries, and Romania from 27 July to 9 August with 25 events and 121 entries. We call these tours because the calendar is so regular. Our data cannot show that anyone planned them in advance.
Two checks limit the reading. Monday is the busiest weekday overall, with 101 of 578 events (17%), yet 42 of 48 run starts (88%) fall on that day. Country labels also come mainly from the group’s own operation hashtags, so the country theme is partly the group’s labelling and not our inference, and runs can overlap.
Europol also describes attacks in waves. It coordinated Operation Eastwood with Eurojust between 14 and 17 July 2025. Its account says that, since investigations began in November 2023, “Germany saw 14 separate waves of attacks targeting more than 250 companies and institutions”.
The 2026 claims carry the operation’s name too: 543 of 578 events use a hashtag built on it. That shows how the group frames its posts. It does not show what the action did to its capacity.
Credit and Rewards Around the Claims
Of 250 posts mentioning the volunteer project, 12 carry reward wording. About 160 posts credit volunteers for camera and industrial-control access claims, extending the credit beyond DDoS (HD-C011). The posts show promises and ranking, not observed payouts or verified access.
Could the Posts Serve as an Incident Feed?
The fair counter-reading is that a stream this regular must track something real, and part of it holds. NoName057(16) had 44 to 74 claim events in every month of our window. A third-party weekly roundup relayed on Telegram moves with our weekly counts of claimed target entries (correlation 0.69 over 27 weeks).
Its figures run at about two thirds of ours. Someone who follows what the group claims will not run short of material.
What the stream cannot do is date or size an outage. The proof is a single check, the claimant flags about three in ten of its own entries and outage wording appears in 13% of headers. We have no availability data for any listed site, so every “down” in these posts is unobserved on our side.
Outside sources point the same way, with limits. After listing attacks in Sweden, Germany, Switzerland and the Netherlands, dated 2023 to 2025, Europol wrote that “these attacks have all been mitigated without any substantial interruptions”. A joint advisory from US and allied agencies in December 2025 says pro-Russia hacktivist groups “regularly make false or exaggerated claims about their attacks on critical infrastructure”. That advisory is about intrusions into industrial systems, not DDoS lists.
Cloudflare found a similar gap on a 2023 campaign by other groups: “despite the hacktivists’ statements, Banking and Financial Services websites were only the ninth most attacked industry”. Its H1 2026 report counts “149 hacktivist DDoS claims against 110 distinct organizations across 16 countries” in the 72 hours after 28 February 2026. It credits the count to outside researchers. Claims are the unit that holds up.
Counting claims has its own trap. The 578 events appear in 1,107 collected posts, and that ratio shifts with which language mirrors we hold, so posts are the wrong unit. How one claim becomes many posts is the subject of a companion article.
The proof format is not unique to this group either. Dark Storm Team’s posts appear in the English-language channel that carries NoName057(16)’s claims, in the same layout: 71 events from May to October (HD-C017).
A commercial ad shows “Down” beside a check link and the words “for sale” (HD-C024). One group credits a commercial DDoS service for its traffic (HD-C022). A check report shows a test result, not who generated the traffic, and our analysis of DDoS-for-hire advertising looks at that commercial side.
The verdict is that the posts are a reliable feed of claims and an unreliable feed of outages.
Triage Steps for a Claim That Names Your Country
The mechanism above turns into a short procedure. The UK’s National Cyber Security Centre urged organisations in January 2026, “particularly local government authorities and operators of critical national infrastructure”, to review their defences. It added that “although DoS attacks are typically low in sophistication, a successful attack can disrupt entire systems”. A claim can overstate impact and still be worth ten minutes.
- Find your exact entries. Claims name pages, not companies. Map each listed page to the service behind it.
- Read the group’s own note. A “geo-locked” or “placeholder” remark means the check may reflect your access policy. Confirm with your own logs whether a country filter or stub page answered the probes.
- Anchor on the post time. The proof gives no duration, so the post timestamp is your only anchor. Review edge, CDN or load-balancer data for the listed hostnames around that time. If nothing shows, record “claimed, no impact seen” with the date.
- Do not assume a window. In 2026, 48 of 102 single-country runs reached five or more events, and 26 were a single event. A first list does not tell you which kind of run it starts. Where a long run did occur, 22 lasted one or two weeks and 18 lasted five or six days, so set a local recheck date, for example the first Sunday.
- Count the claim once. The same list may reach you in two or three posts and languages. Open one case per event and keep the posts as attachments.
- Triage data claims separately. A data claim can follow a DDoS list within hours. Check it against your own records, not against the reachability link.
For public statements, the safe line is one you can back with your own data: what the group claimed, when, and what you measured. The same discipline applies to claim lists on leak sites, which we examined in our analysis of ransomware leak-site claims.
Evidence and Scope
We classified 8,839 Blackhole-collected posts dated 1 January to 27 October 2026. Of these, 1,774 list targets as attacked or down, and we grouped the claims into 1,204 events across all groups. The 578 NoName057(16) events carry 2,920 claimed target entries. Entry-level shares of remarks and sectors use the 2,883 entries whose lines we could parse; 37 entries sit in nine events with unparsed lines.
Dates are recorded post dates, and every entry is a claimed target, not a confirmed one. We did not open or read the third-party check reports, and we hold no availability data for the listed sites. The collection is dominated by Telegram, and the group’s channels reach it through mirrors that change. The Russian-language project channel appears only from January to June, and channel coverage fell between July and September.
An independent reader checked our labels. For 40 sampled claim posts, 39 matched our class (97.5%). Overall labels agreed on 164 of 199 sampled posts (82%) pooled and on 33 of 48 (69%) in the cleaner holdout, and the samples are stratified. Across 20 sampled events, the number of listed targets was right in all 20, the country in 17 and the group label in 18.
Sector was right for 48 of 61 sampled targets, so we use it only at a coarse level. We give no counts of third-party relay posts or of recruitment posts as classes, because their labels agreed only about half the time. The 250 and 12 in the volunteer section are posts we read and counted by wording. The 160 access-claim posts rest on a class that was about 89% right.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
The 30 selected records behind this article are in the hacktivist claim catalogue, chosen to show formats and not to measure prevalence. The research methodology explains the units and the rules. Group names are labels in the text and never people.
Related reading: the Hacktivism and DDoS research edition and the Fraud chapter, which shows how repeated posts inflate counts in another corner of the same data. Our glossary explains DDoS attack and hacktivism. The incident record on NoName057(16) campaigns against Italy gives earlier background.
