The study, published as an open access teaching case in the Journal of Information Technology Teaching Cases, is the first of its kind to dissect the complete modus operandi and operating model of the group. DDoS attacks themselves are not a new phenomenon. By flooding targeted servers with overwhelming traffic, they can shut down public services, knock banking platforms offline and disrupt critical infrastructure. But Assistant Professor Hadi Ghanbari, the study’s lead author, argues that focusing on these technical disruptions fundamentally misreads the threat. The real objective, he contends, is not the outage itself but the erosion of public confidence that follows it.

“NoName057(16) and other such groups actively aim to undermine public trust in governments, institutions, and countries seen as hostile to Russian interests,” Ghanbari explains. “It’s easy to focus on the financial costs, but the more hidden risk is if people lose confidence in large organisations or government services, then the next step is for them to ask what’s the point of having them.” In other words, a website that returns after a few hours is not the point of the attack. The lingering question in citizens’ minds, whether their institutions can protect them at all, is.

Finland has become a particularly instructive case study. Since January 7, 2025, NoName057(16) has launched 23 rounds of DDoS attacks against Finnish targets, affecting 129 public and private organisations. The timing is not coincidental. Researchers note a marked uptick in attacks against the country since it joined NATO in 2023, a move that repositioned Finland squarely within the group’s crosshairs. The targets read like a blueprint of national infrastructure: the Parliament of Finland, numerous governmental institutions, municipalities, banks and financial institutions, and providers of critical infrastructure services. Each attack round serves as both a disruption and a message, demonstrating to the Finnish public and policymakers alike that the country’s digital front door can be rattled at will.

Perhaps the most striking finding of the research is the group’s operational architecture, which Ghanbari describes as genuinely unprecedented. NoName057(16) recruits volunteers through the messaging platform Telegram, cultivating the image of a politically motivated hacktivist movement. Yet beneath this ideological veneer lies an incentive system more characteristic of organised cyber-crime. Evidence drawn from the dark web indicates that members receive cryptocurrency-based rewards of up to USD 1,200 for successful attacks. The group also forms alliances and collaborates with other hacking collectives, at least one of which is linked to the Russian cyber army.

“They claim to be hacktivists but they have an incentive system more common for cyber criminals. They also collaborate and form alliances with other hacker groups,” says Ghanbari. “Essentially, they have gamified their operating model. This is something new—we haven’t seen this hybrid model before.” The gamification is more than a metaphor. By turning attack participation into a point-scoring, reward-earning activity, the group has industrialised the recruitment and motivation of what would otherwise be a loose crowd of sympathisers. Volunteers are transformed into a distributed, paid and ideologically motivated workforce, capable of launching coordinated attacks across multiple countries simultaneously.

The implications of this model place NoName057(16) in a category that existing frameworks struggle to contain. The research identifies a new class of hybrid warfare occupying the grey zone between hacktivism, state-sponsored cyber warfare and cyber-criminality. The group borrows the legitimacy narrative of the hacktivist, the financial machinery of the criminal and, through its alliances, the strategic direction of state-aligned actors. Ghanbari urges that such groups should not be understood as ordinary hackers or conventional hacktivists at all, but as hybrid threat actors functioning strategically to wage geopolitical and psychological warfare. This reframing matters because it changes how defenders should respond, from purely technical incident handling to a broader contest over narrative and public confidence.

Intriguingly, the study warns that the victims of these attacks may inadvertently become their own worst enemies. Ghanbari cautions that when governments and companies attempt to downplay the nature or extent of such attacks in their public communications, they can play directly into the hackers’ hands. “The point is to escalate the psychological cost of their actions. It’s a complex game,” he warns. “Companies and governments can play into the hackers’ hands if they’re not transparent.” A minimising statement intended to reassure the public can instead be reframed by adversaries as evidence of concealment or incompetence, amplifying precisely the distrust the attackers sought to create.

This insight leads to one of the study’s most actionable recommendations: in the aftermath of a reputational or psychological cyberattack, cybersecurity experts should work closely with public relations and communications professionals. Counteracting propaganda and psychological intimidation, the research suggests, requires a joined-up response in which technical teams restore systems while communication teams restore confidence. Treating the two as separate functions leaves the psychological battlefield undefended, which is exactly where the attackers prefer to operate.

The reach of NoName057(16) extends well beyond NATO and the European Union. The group’s recent attacks on Israeli infrastructure illustrate how its targeting follows geopolitical fault lines rather than geographic boundaries. “Nations who have come out in support of the US are getting more DDoS attacks than anyone else,” says Ghanbari. “Anyone considered an ‘enemy of Russia’—which includes those nations who are even discussing joining NATO—have been attacked.” The group has also been active amid the Iran-US conflict, demonstrating how crowdsourced cyber aggression can be redeployed rapidly to whatever flashpoint best serves its strategic narrative. For countries merely debating NATO accession, the threat has already arrived, long before any treaty is signed.

From a societal perspective, the stakes are considerable. DDoS disruptions can block access to essential services for millions of citizens, yet Ghanbari observes that the costs borne by ordinary users rarely receive the attention they deserve. “Not only does it undermine their basic rights, it also undermines the ideological system that underpins them,” he notes. When citizens cannot reliably access government portals, banking services or municipal resources, the damage accumulates not just in lost hours but in the slow corrosion of the democratic and institutional fabric that those services represent. The attack, in this reading, is aimed at the social contract itself.

The study, titled “The blurring lines of hacktivism and crowdsourced cyber warfare: How NoName057(16) weaponises distributed denial of service attacks,” has been made available online as an open access resource, reflecting its value not only for researchers but also for practitioners tasked with defending democratic societies against this evolving form of aggression. As gamified, financially incentivised and ideologically charged cyber campaigns continue to proliferate, the research offers a sobering reminder: the most important battleground in these attacks is not the server, but the mind of the citizen.

News Publication Date: 31-Aug-2026

Web References: Not provided

References: Ghanbari, H., et al. “The blurring lines of hacktivism and crowdsourced cyber warfare: How NoName057(16) weaponises distributed denial of service attacks.” Journal of Information Technology Teaching Cases. https://doi.org/10.1177/20438869261462968