A pro-Russian hacktivist group known as NoName057(16) recently launched new attacks against organizations and companies in Poland, Lithuania and other countries. Most recently, this group began targeting his website of a Czech presidential candidate.
according to sentinel oneI found a new campaign.
Tom Hegel, senior threat researcher at SentinelOne, wrote:
“This includes using GitHub pages to host DDoS tool websites freely. […] And the relevant GitHub repository for hosting the latest versions of the tools advertised on our Telegram channel. “
In this regard, SentinelOne said it reported the abuse to GitHub’s Trust and Safety team, who took action and removed the malicious account.
Regarding the motives behind the NoName057(16) group, security researchers have determined that the hackers are primarily focused on sabotaging national websites important to Russia’s invasion of Ukraine.
“Initial attacks focused on Ukrainian news websites, but later shifted to NATO-related targets,” Hegel explains.
“For example, the first disruption that the group claimed responsibility for was a DDoS attack against Ukrainian news and media websites Zaxid, Fakty UA, and others in March 2022. I’m focused on silencing what I consider to be Russian.”
Hegel also clarified that from a technical point of view, NoName057(16) is not particularly sophisticated. Still, groups can impact service availability, often for short periods of time.
The security expert added, “What this group represents is growing interest in volunteer attacks and increasing payments to the most influential contributors.” “We hope that such groups will continue to thrive in today’s highly contentious political climate.”
A list of Indicators of Compromise (IoCs) for NoName057(16) is available on SentinelOne. Recommendation.
The disclosure comes days after security firm Lupovis revealed that separate groups of Russian hackers were leveraging their presence within the networks of several national organizations. Launch an attack against Ukraine.
