Hacktivism & DDoS: The Report
Hacktivist groups and DDoS-for-hire sellers both post target lists with a reachability-check link as proof. A hacktivist DDoS claim is a campaign notice, not an outage report; a for-hire ad sells time offline or rented capacity to a private buyer.
- 578
- Distinct NoName057(16) claim eventsCarrying 2,920 claimed target entries, 1 January to 27 October 2026.
- 89.7%
- 6,028 of 6,723 collected for-hire ad postsare a single Chinese-language for-hire advertisement.
- 13%
- Claim events with outage wording in the header77 of 578 claim events. A claim post records a claim, not an outcome.
Brandefense / Cybercrime Report 2026 / Hacktivism & DDoS Hacktivism and DDoS: What the Claim Posts Record 1 January-27 October 2026. Dataset v1.0. Collected posts and claims, not attacks. Get The Hacktivism & DDoS Report.
Read the report, open the evidence records and reuse the charts with their source and limits.
Edition 1.0 · 1 January–27 October 2026 · Free access · 30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Three Investigations. Campaign Notices And Time Offline For Sale.
The report sets out the full file behind the chapter: 578 distinct NoName057(16) claim events carrying 2,920 claimed target entries, 1 January to 27 October 2026. It adds the per-event anatomy, the weekly country-tour pattern and the claim-versus-outage limit.
It also covers the commercial side. A single Chinese-language for-hire advertisement is 6,028 of 6,723 collected for-hire ad posts (89.7%), and the catalogues record the offer and claim formats behind every figure.
The full-year PDF edition follows in early 2027. The accessible HTML edition carries the same text, numbers and catalogues for screen readers and copy-out, and the data package holds the underlying counts.
- 01 Hacktivist DDoS Claims Are Campaign Notices, Not Incident Reports We read 578 NoName057(16) claim events from 2026. A post is usually a political notice with about five sites and a one-moment check, not an outage record. Read online →
- 02 What DDoS-for-Hire Ads Sell That Hacktivist Claims Don't DDoS-for-hire ads sell time offline or rented capacity, from rival takedowns to phishing cleanup. Read online →
- 03 One Hacktivist Claim, Many Posts: Which Unit to Count One NoName057(16) claim averages 1.92 collected posts. See why claim events, not posts, are the right unit when a group names your country. Read online →
- 04 Method, limits and the evidence catalogue. A post is not an incident, and an ad does not prove a sale or show that a tool works.
Inspect The Evidence Behind The Report.
Reuse our charts with their source, dates and limits.
Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.
AI disclosureBrandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
- 01These are collected posts and claim units in saved Blackhole queries, not attacks, outages, victims, advertisers, sales or market size.
- 02Blackhole is Telegram-dominated; forum, Discord and paste posts are about 1 to 5% of these sets. Tor markets and closed communities are not represented.
- 03No claimed target is verified. A reachability report from foreign check nodes cannot tell a flooded site from one that refuses foreign visitors.
- 04Group names are labels in post text, not people; channel counts are lower bounds.
- 05Catalogue records are purposive selections, not samples. Advertised prices and capacities are the advertiser’s wording; no price index or average is produced.
From Research To Monitoring.
See when your company's passwords, data or name show up on criminal forums and markets.
See how it worksCheck Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.