Log in Request a demo

Significant cyber incident

NoName057(16) DDoS campaigns against Italy

From December 2024 Italian government bodies, airports and transport firms were hit by waves of DDoS attacks claimed by the pro-Russian group NoName057(16).

In short

From December 2024 Italian government bodies, airports and transport firms were hit by waves of DDoS attacks claimed by the pro-Russian group NoName057(16). The attacks flooded public websites with traffic and made them unreachable, usually for a short time. The Italian national cybersecurity agency (ACN) says they were noisy but did not touch flight systems or data. In July 2025 a European police and judicial operation took the group down.

Last updated October 2026

What happened

On 28 December 2024, from about 8 in the morning, websites of transport firms and of the Italian Foreign Ministry suffered outages caused by DDoS attacks. ACN says NoName057(16) claimed the attacks on its own Telegram channel. The sites of Milan Malpensa airport, Milan Linate airport and the Ministry of Foreign Affairs were unreachable for a short time. ACN says flights ran as normal: only the public websites were affected, not the systems that manage flights.

The attacks continued. ACN reported a new wave over the weekend before 13 January 2025, again claimed on Telegram and citing Italy’s continued assistance to Ukraine. Its monthly summary for December 2024 counted 137 DDoS attacks, of which about 30% caused visible disruption. For February 2025 it counted 181, of which only 3% caused disruption, usually for about an hour. In March 2025 it counted 76, a fall of 60%.

ACN also recorded a larger pro-Russian campaign in June 2025 that lasted 13 days, with 275 attacks against 124 targets. ACN’s summary does not name the group behind it, so this page does not attribute it to NoName057(16).

In action days on 14–17 July 2025 authorities from twelve countries, with Eurojust and Europol, took down NoName057(16). Searches took place in several countries including Italy. Seven arrest warrants were issued, including against the main instigators living in Russia.

Timeline

  1. 28 December 2024

    From about 08:00 DDoS attacks make the Malpensa and Linate airport sites and the Foreign Ministry site unreachable; NoName057(16) claims them on Telegram.

  2. 28 December 2024

    ACN says all affected sites are back online, with CSIRT Italia support; flights are not affected.

  3. December 2024

    ACN counts 137 DDoS attacks in the month; about 30% cause visible disruption.

  4. Weekend before 13 January 2025

    A new wave hits many institutional sites and companies; the attacks are claimed on Telegram.

  5. 13 January 2025

    ACN publishes its account of the wave and the work of its CSIRT.

  6. February 2025

    ACN counts 181 DDoS attacks; only 3% cause disruption.

  7. 22 February 2025

    ACN publishes a report on DoS and DDoS threats with mitigation advice.

  8. March 2025

    ACN counts 76 DDoS attacks, 60% fewer than in February.

  9. June 2025

    A pro-Russian campaign runs for 13 days with 275 attacks on 124 targets (group not named by ACN).

  10. First half of 2025

    DDoS attacks rise 77% against the first half of 2024, from 336 to 598.

  11. 14–17 July 2025

    Action day: the NoName057(16) botnet is shut down and seven arrest warrants are issued.

  12. 16 July 2025

    Eurojust publishes the press release, stating that searches took place in Italy among other countries.

  13. February 2026

    Around the opening of the Milano Cortina Winter Olympics pro-Russian groups hit hotels, public bodies and transport; ACN does not name NoName057(16).

How the attack worked

The sources describe a simple but organized method. A DDoS attack floods a website with traffic until it cannot answer real visitors. It does not break into the site or steal data. ACN’s deputy director said in December 2022 that such attacks are noisy but do not touch the integrity or confidentiality of data.

Step 1: recruit helpers and build a botnet

Eurojust says the group recruited supporters through a messaging service. It estimates around 4000 users downloaded malware that let them join the attacks. The group also built its own botnet from hundreds of servers around the world to raise the attack load.

Step 2: flood chosen targets

ACN says the December 2024 attacks were tied to political events and to Italy’s international position, and the January 2025 attacks were claimed with reference to Italian help for Ukraine. Targets were public administration, transport and government sites.

Step 3: claim and publicise

The group claimed the attacks on its Telegram channel. ACN says the February 2025 attacks were used to win media visibility and spread propaganda.

Step 4: mitigation

ACN alerted the targets from the start. The affected organizations carried out the mitigation, with support from CSIRT Italia. Sites were back online the same day on 28 December 2024.

How the attack ran
  1. Recruit helpersSupporters recruited through a messaging service download malware; the group also runs its own botnet
  2. Flood the siteTraffic overloads public websites of government, airports and transport firmsTechnique T1498 (MITRE ATT&CK, opens in a new tab)
  3. OutageSites become unreachable, usually for a short time; flight systems are not touched
  4. Public claimThe group claims the attacks on its Telegram channel
  5. MitigationTargets and CSIRT Italia filter the traffic and restore the sites

Who says who was behind it

The December 2024 and January 2025 waves were claimed by NoName057(16) on Telegram, as reported by ACN. In July 2025 Eurojust named NoName057(16) as the hacktivist group taken down, and said it has professed support for Russia since the start of the war against Ukraine. ACN does not attribute the June 2025 campaign or the February 2026 Olympics attacks to a named group, so they are not attributed here.

Impact

Services: the Malpensa and Linate airport sites and the Foreign Ministry site were unreachable for a short time on 28 December 2024. ACN says flights were not affected.
Scale: ACN counted 137 DDoS attacks in December 2024 (about 30% with visible disruption), 181 in February 2025 (3% with disruption, usually about an hour) and 76 in March 2025. DDoS attacks in the first half of 2025 rose 77% to 598.
Data: no data theft is reported by ACN for these DDoS waves.
Group: Eurojust says authorities disrupted over 100 servers worldwide on the action day, and informed the group and supporters about their criminal liability.

Government and regulator response

  • 28 December 2024: ACN alerted the target sites and worked with the affected organizations on mitigation. All sites were back online the same day.
  • 13 January 2025: ACN said its CSIRT worked to support affected bodies and restore their sites.
  • 22 February 2025: ACN published a report on DoS and DDoS threats with general advice and an annex of countermeasures.
  • 14–17 July 2025: twelve countries with Eurojust and Europol shut down the group’s botnet and issued seven arrest warrants. Searches took place in Italy among other countries.

Lessons

  1. Expect DDoS around political events

    ACN links the attacks to political events and Italy's international position. Plan extra capacity and contacts before such dates.

  2. Separate public sites from operational systems

    At the airports only the public websites went down, not the flight systems. Keep them apart.

  3. Tell the national CSIRT early

    ACN alerted targets from the start and CSIRT Italia supported mitigation, which brought sites back the same day.

  4. Most attacks fail, but prepare for the 3% to 30% that work

    ACN counted 3% disruption in February 2025 and about 30% in December 2024. Good mitigation changes the odds.

  5. Test your response plan

    ACN's report advises tested response plans and trained staff.

  6. International action works

    The July 2025 takedown showed shared investigation by many countries can reduce the activity.

What to check in your own organization

  1. DDoS protection

    Check that public websites sit behind traffic filtering or a scrubbing service that can absorb large floods.

  2. Contacts

    Know how to reach your hosting provider, your ISP and CSIRT Italia quickly.

  3. Separation

    Confirm public websites are separate from operational systems, so an outage does not stop operations.

  4. Response plan

    Have a written DDoS plan and test it at least once a year.

  5. Monitoring

    Alert on sudden traffic spikes and slow responses, and keep the logs.

  6. Event calendar

    List political and national events when attacks are likely and raise readiness for them.

  7. Communication

    Prepare a short public notice saying the site is affected and that data is not touched.

Questions

Who is NoName057(16)?

A hacktivist group that has professed support for Russia since the start of the war against Ukraine, according to Eurojust.

What did the attacks do?

They made public websites unreachable for a short time. ACN says they did not affect flight systems.

Was any data stolen?

ACN reports no data theft for these DDoS waves. A DDoS attack floods a site with traffic and does not break into it.

Was the group stopped?

In action days on 14–17 July 2025 authorities from twelve countries took down its botnet and issued seven arrest warrants. Searches took place in Italy among other countries.

Were the June 2025 and Olympics 2026 attacks by the same group?

ACN does not say. It attributes them to pro-Russian groups in general.

How many attacks were there?

ACN counted 137 in December 2024, 181 in February 2025, 76 in March 2025 and 598 in the first half of 2025.

In our research

  1. Hacktivism and DDoS in 2025: ENISA’s top groups October 2026
  2. Most targeted EU sectors in 2025: the ENISA ranking October 2026

Sources

  1. Sono tutti online i siti colpiti dagli attacchi DDoS degli attivisti (28 December 2024) ACN
  2. Agenzia per la cybersicurezza nazionale in azione contro gli attacchi hacker all'Italia (13 January 2025) ACN
  3. Il rapporto CSIRT di dicembre (Operational Summary December 2024) ACN
  4. Operational Summary February 2025 ACN
  5. Operational Summary di marzo (March 2025) ACN
  6. Cyberattacchi in Italia, first half of 2025 ACN
  7. ACN publishes the report on DDoS attacks (22 February 2025) ACN
  8. Hacktivist group responsible for cyberattacks on critical infrastructure in Europe taken down (16 July 2025) Eurojust
  9. Operational Summary first half of 2026 ACN
  10. Attacchi DDoS, Vice Direttore: rumorosi, ma nessun danno (5 December 2022) ACN

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

DDoS attack

A DDoS attack is a distributed denial-of-service attack, where many machines work together to flood one target so that legitimate users cannot reach it.

Read more

Glossary term

Hacktivism

Hacktivism is the use of hacking to push a political, social or ideological cause.

Read more