{ "version": "1.0", "built_date": "2026-10-30", "title": "Hacktivism and DDoS: What the Claim Posts Record", "creator": "Brandefense Research Team", "source": "Brandefense Blackhole", "period": { "start": "2026-01-01", "end": "2026-10-27", "timezone": "as_recorded", "query_window_timezone": "UTC", "partial_month": "2026-10", "label": "1 January–27 October 2026", "date_field": "post.created_at", "date_semantics": "Recorded source post dates; not the date of any attack, outage or confirmation." }, "summary": { "query_sets": 25, "sets_overlap_note": "Sets overlap; exact totals must not be added across sets as unique posts.", "retrieval_windows": 1077, "window_modes": { "sample": 102, "full": 758, "count": 217 }, "claim_posts_classified": 8839, "target_claim_posts": 1774, "claim_events_all_groups": 1204, "claimed_target_entries_all_groups": 4341, "noname057_16": { "collected_posts": 1107, "distinct_texts": 1090, "claim_events": 578, "claimed_target_entries": 2920, "self_annotated_entries": 851, "parsed_entries": 2883, "self_annotated_share_of_parsed_pct": 29.5, "posts_per_event": 1.92 }, "for_hire_ads": { "collected_posts": 6723, "distinct_texts": 955, "template_clusters": 259, "pool_posts_ten_sets": 22432 }, "ddos_keyword_may_jun": { "estimated_posts": 47623.0, "for_hire_ad_share": 0.8693, "largest_cluster_share": 0.8264, "basis": "estimated from samples" }, "validation": { "independent_pooled_agreement": "164/199", "independent_clean_holdout": "33/48", "target_claim_class": "39/40", "event_target_count": "20/20" } }, "sets": [ { "set_id": "c_ddos", "label": "Platform class label DDOS", "kind": "class", "exact_total_posts": 140985, "fetched_posts": 4798 }, { "set_id": "k_ddos", "label": "Keyword: ddos", "kind": "keyword", "exact_total_posts": 93672, "fetched_posts": 5922 }, { "set_id": "k_noname057", "label": "Keyword: noname057", "kind": "keyword", "exact_total_posts": 2319, "fetched_posts": 2264 }, { "set_id": "k_hacktivist", "label": "Keyword: hacktivist", "kind": "keyword", "exact_total_posts": 894, "fetched_posts": 885 }, { "set_id": "n_cc_attack_zh", "label": "Keyword: CC攻击 (Chinese, \"CC attack\")", "kind": "keyword", "exact_total_posts": 52717, "fetched_posts": 4781 }, { "set_id": "n_stress_test_zh", "label": "Keyword: 压力测试 (Chinese, \"stress test\")", "kind": "keyword", "exact_total_posts": 3640, "fetched_posts": 3633 }, { "set_id": "n_ddos_attack", "label": "Keyword: ddos attack", "kind": "keyword", "exact_total_posts": 2624, "fetched_posts": 2607 }, { "set_id": "n_noname057_16", "label": "Keyword: noname057(16)", "kind": "keyword", "exact_total_posts": 2116, "fetched_posts": 2064 }, { "set_id": "n_stresser", "label": "Keyword: stresser", "kind": "keyword", "exact_total_posts": 1913, "fetched_posts": 1905 }, { "set_id": "n_booter", "label": "Keyword: booter", "kind": "keyword", "exact_total_posts": 1066, "fetched_posts": 1066 }, { "set_id": "n_handala", "label": "Keyword: handala", "kind": "keyword", "exact_total_posts": 1009, "fetched_posts": 1007 }, { "set_id": "n_garuda", "label": "Keyword: garuda", "kind": "keyword", "exact_total_posts": 859, "fetched_posts": 725 }, { "set_id": "n_reach_check", "label": "Reachability-check keyword", "kind": "keyword", "exact_total_posts": 776, "fetched_posts": 770 }, { "set_id": "n_keymous", "label": "Keyword: keymous", "kind": "keyword", "exact_total_posts": 438, "fetched_posts": 436 }, { "set_id": "n_project_kw", "label": "Volunteer-project keyword", "kind": "keyword", "exact_total_posts": 244, "fetched_posts": 244 }, { "set_id": "n_dienet", "label": "Keyword: dienet", "kind": "keyword", "exact_total_posts": 196, "fetched_posts": 195 }, { "set_id": "n_ip_stresser", "label": "Keyword: ip stresser", "kind": "keyword", "exact_total_posts": 139, "fetched_posts": 139 }, { "set_id": "n_z_pentest", "label": "Keyword: z-pentest", "kind": "keyword", "exact_total_posts": 120, "fetched_posts": 120 }, { "set_id": "n_killnet", "label": "Keyword: killnet", "kind": "keyword", "exact_total_posts": 113, "fetched_posts": 111 }, { "set_id": "n_ddos_for_hire", "label": "Keyword: ddos for hire", "kind": "keyword", "exact_total_posts": 86, "fetched_posts": 86 }, { "set_id": "n_server_killers", "label": "Keyword: server killers", "kind": "keyword", "exact_total_posts": 46, "fetched_posts": 46 }, { "set_id": "n_dark_storm", "label": "Keyword: dark storm", "kind": "keyword", "exact_total_posts": 33, "fetched_posts": 33 }, { "set_id": "n_sector_16", "label": "Keyword: sector 16", "kind": "keyword", "exact_total_posts": 11, "fetched_posts": 10 }, { "set_id": "n_cyber_army_russia", "label": "Keyword: cyber army of russia", "kind": "keyword", "exact_total_posts": 10, "fetched_posts": 9 }, { "set_id": "n_mr_hamza", "label": "Keyword: mr hamza", "kind": "keyword", "exact_total_posts": 6, "fetched_posts": 5 } ], "units": { "collected_post": "A Blackhole post ID collected by a query; not an attack, offer, actor or transaction.", "distinct_text": "Normalised text with links removed; translations count as distinct.", "template_cluster": "Texts joined by shared full text or shared 100-character head/tail after handles, links and digits are removed; not a count of advertisers.", "claim_event": "Same group, same target set, same day, across channels and languages.", "claimed_target_entry": "A target listed inside a claim; not a verified attack or confirmed victim.", "estimated_posts": "Sampled windows scaled by window total / posts fetched." }, "definitions": { "self_annotated_entry": "A listed entry carrying the claimant’s own geo-block, dead-ping or placeholder remark.", "for_hire_ad": "A post that advertises a DDoS service, plan, tool, botnet access or hold service as its main subject, with an offer cue." }, "findings": [ { "id": "claim-list", "title": "A NoName057(16) claim is a list with a political header.", "text": "1,107 collected target-claim posts form 578 claim events listing 2,920 target entries (median 5 per event). Most entries carry a third-party reachability-check link; the link does not establish execution or its result.", "evidence": "relay-ladder.csv, claim-events-monthly.csv, claim-catalog.html", "limit": "Listed entries are claims. No outage, duration or user impact is shown." }, { "id": "own-remarks", "title": "About three in ten parsed entries (29.5%) carry the claimant’s own remark.", "text": "851 of 2,883 parsed entries (2,920 claimed in all) are marked by the claimant as closed for geographic reasons, dead by ping or behind a placeholder page.", "evidence": "relay-ladder.csv, HD-C001, HD-C004, HD-C005", "limit": "Remark detection missed some Spanish-language phrases; share likely within a few points (independent spot check: 34 of 39 posts exact)." }, { "id": "relay", "title": "One claim is collected as 1.1 to 2.3 posts, depending on coverage.", "text": "1.92 posts per claim event overall; 2.25 with Russian, English and Spanish mirrors collected; 1.1 with only the English mirror (July–August).", "evidence": "relay-lags.csv, relay-ladder.json", "limit": "The multiplier depends on which mirrors the collection holds, not on group behaviour." }, { "id": "ddos-spike", "title": "87% of the May–June ddos keyword volume was for-hire advertising.", "text": "Of an estimated 47,623 collected posts for the keyword ddos in May–June, 86.9% are for-hire ads and one template cluster is 82.6%.", "evidence": "spike-composition.csv, offer-posts-monthly.csv, chart-ddos-spike-composition", "limit": "Estimated from a 5,922-post sample; coverage changes; no trend in DDoS activity is claimed." }, { "id": "ad-units", "title": "For-hire ads sell outcomes in small units.", "text": "Across 259 ad template clusters (6,723 collected posts, 955 distinct texts), plans, slots, days and hours are the advertised units; 130 clusters show a price or price list and 152 ask for contact only.", "evidence": "offer-terms-summary.csv, offer-price-terms.csv, offer-catalog.html", "limit": "Advertised terms only; availability, capacity and delivery were not tested. Clusters are not advertisers." }, { "id": "keyword-hygiene", "title": "Keyword counts hide bots, ads and alliance tags.", "text": "One welcome-bot message (448 copies) is 93% of the 480 September–October posts of the keyword hacktivist (448 of 885 over the year); an alliance hashtag list brings other group names into the noname057 set.", "evidence": "inflation-mechanisms.csv", "limit": "Mechanisms identified by reading; other noise sources may remain." } ], "limitations": [ "These are collected posts and claim units in saved Blackhole queries, not attacks, outages, victims, advertisers, sales or market size.", "Blackhole is Telegram-dominated; forum, Discord and paste posts are about 1 to 5% of these sets. Tor markets and closed communities are not represented.", "Three sets (class DDOS, keyword ddos, Chinese-language CC attack) are sampled; their shares are estimates and estimates of overlapping sets must not be added.", "A full-fetch label does not guarantee complete retrieval: the API sometimes returned fewer posts than its exact total, mostly in late summer.", "Collection coverage changed in July (channel coverage fell from about 600 to about 390 in an equal subsample); posts-per-claim and month-to-month counts follow which language mirrors are collected.", "No claimed target is verified. A reachability report from foreign check nodes cannot tell a flooded site from one that refuses foreign visitors.", "The classification is by AI readers. Independent agreement is 82% pooled (164 of 199) and 69% on the clean frozen-rules holdout (33 of 48); claim-relay and recruitment classes are about 50%. Sector is coarse only.", "Group names are labels in post text, not people; channel counts are lower bounds; the words garuda, anonymous, hacktivist and handala are ambiguous.", "Catalogue records are purposive selections, not samples. Advertised prices and capacities are the advertiser’s wording; no price index or average is produced.", "No early-warning value, causal link to political events, or capacity claim is established. Brandefense analysts approved the findings." ], "assets": { "manifest": "hacktivism-ddos-data.json", "observed_records_csv": "observed-records.csv", "claim_events_csv": "claim-events-monthly.csv", "weekly_claims_csv": "weekly-claims.csv", "claim_catalogue_html": "claim-catalog.html", "claim_catalogue_json": "claim-catalog.json", "offer_catalogue_html": "offer-catalog.html", "offer_catalogue_json": "offer-catalog.json", "price_terms_csv": "offer-price-terms.csv", "offer_terms_summary_csv": "offer-terms-summary.csv", "offer_templates_csv": "offer-templates-summary.csv", "offer_posts_monthly_csv": "offer-posts-monthly.csv", "spike_composition_csv": "spike-composition.csv", "relay_ladder_csv": "relay-ladder.csv", "relay_ladder_json": "relay-ladder.json", "relay_lags_csv": "relay-lags.csv", "inflation_mechanisms_csv": "inflation-mechanisms.csv", "channel_concentration_json": "channel-concentration.json", "retrieval_windows_csv": "retrieval-windows.csv", "unit_csv": "counting-units.csv", "precision_validation": "precision-validation.json", "methodology": "methodology.html", "dictionary": "data-dictionary.html", "press": "press-kit.html", "license": "license.html", "leak_scan": "leak-scan.json", "charts": [ { "id": "weekly-claims", "title": "Weekly NoName057(16) claim events and listed target entries", "svg": "chart-weekly-claims.svg", "png": "chart-weekly-claims.png", "alt": "Bar charts of NoName057(16) claim events (maximum 21 a week) and listed target entries (maximum 115 a week) by ISO week in 2026, 44 weeks, with July and August shaded because only the English mirror was collected.", "article": "package (press kit and report only)" }, { "id": "claim-ladder", "title": "One claim, five different counts", "svg": "chart-claim-ladder.svg", "png": "chart-claim-ladder.png", "alt": "NoName057(16): 1,107 collected posts, 1,090 distinct texts, 578 claim events, 2,920 listed target entries, of which 851 carry the claimant's own remark.", "article": "package (press kit and report only)" }, { "id": "ddos-spike-composition", "title": "The May–June ddos keyword spike is mostly for-hire ads", "svg": "chart-ddos-spike-composition.svg", "png": "chart-ddos-spike-composition.png", "alt": "Estimated collected posts per month for the keyword ddos, split into the for-hire ad label and everything else. In May and June about 87% of estimated posts are for-hire ads. Estimated from samples.", "article": "package (press kit and report only)" }, { "id": "offer-units", "title": "Advertised units in for-hire ad template clusters", "svg": "chart-offer-units.svg", "png": "chart-offer-units.png", "alt": "Counts of ad template clusters out of 259 by advertised unit: plans, concurrency slots, per day, per hour, per link; with the number showing no price and the number showing a price.", "article": "package (press kit and report only)" }, { "id": "weekly-tours", "article": "hacktivist-ddos-claims-2026", "title": "In 22 of 44 weeks, one country received 70% or more of NoName057(16)'s claimed target entries", "svg": "chart-weekly-tours.svg", "png": "chart-weekly-tours.png", "alt": "Stacked weekly columns of claimed target entries for NoName057(16), 29 December 2025 to 26 October 2026, each column showing the leading country; in 22 of 44 weeks one country took 70% or more." }, { "id": "ddos-ad-targets", "article": "ddos-for-hire-ads-2026", "title": "Which targets do for-hire ads name?", "svg": "chart-ddos-ad-targets.svg", "png": "chart-ddos-ad-targets.png", "alt": "Horizontal bars of template clusters by named target type, out of 259 clusters: generic websites and servers 144, gambling and betting 49, phishing or lookalike sites framed as takedown 48 (19%), competitors 38, game servers 21, government and education 19, apps 13, online shops 6, news sites 4. One cluster can name several types." }, { "id": "claim-posts-vs-events", "article": "hacktivist-claim-relay-counts", "title": "Do collected posts and claim events move together?", "svg": "chart-claim-posts-vs-events.svg", "png": "chart-claim-posts-vs-events.png", "alt": "Two lines by month, January to October 2026, for NoName057(16): collected claim posts fall from 192 in March to 64 in July (minus 67%) while claim events fall from 74 to 59 (minus 20%). Background bands show which language mirrors were collected." } ], "article_charts": [ "weekly-tours", "ddos-ad-targets", "claim-posts-vs-events" ], "social": { "cover": "social-cover.png", "claims": "social-claims.png", "forhire": "social-forhire.png", "relay": "social-relay.png" }, "pdf": "hacktivism-ddos-report-2026.pdf", "reader": "hacktivism-ddos-report-2026.html", "cover": "hacktivism-ddos-report-cover.png", "dictionary_json": "data-dictionary.json" }, "validation_summary": { "independent_reviewer_pooled": "164 of 199 (82%)", "independent_clean_holdout": "33 of 48 (69%)", "writer_holdout_not_reproduced": "39 of 48 (81%)", "claim_relay_recruitment": "about 50%; indicative only", "file": "precision-validation.json" }, "ai_disclosure": "Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone. Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.", "byline": "Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.", "license": "CC BY 4.0 for original aggregates, charts and editorial paraphrases; raw source content is excluded.", "attribution": "Source: Brandefense Research Team, Hacktivism and DDoS: What the Claim Posts Record, 2026, v1.0. Data: Brandefense Blackhole, 1 January–27 October 2026. Collected posts and claims, not attacks or market totals." }