Hacktivism

Executive Summary

Hacktivism in 2025-2026 is driven by two conflicts: Russia's war against Ukraine and the confrontation between Iran, Israel and the United States. Activity tracks military and political events closely. Radware recorded a peak in public DDoS claims in Q2 2025, a contraction afterwards, and a 103% month-over-month jump in March 2026 following the US and Israeli strikes on Iran that began on 28 February 2026 [19][20]. Europe receives roughly half of all claimed hacktivist DDoS attacks, and government is the most targeted sector [19][20].

The question of whether the main pro-Russian brands are grassroots or state-run has largely been answered by governments. In December 2025 the US Department of Justice and a joint advisory from CISA, FBI, NSA and international partners stated that Cyber Army of Russia Reborn (CARR) was created and funded by the GRU, and that NoName057(16) was created by CISM, an organization established on behalf of the Kremlin [11][12]. Denmark's Defence Intelligence Service assessed that Z-Pentest and NoName057(16) both have links to the Russian state and are used as instruments of hybrid war [13]. On the Iranian side, vendors describe Handala as linked to the Ministry of Intelligence and Security (MOIS) and Cyber Av3ngers as affiliated with the IRGC [17][23].

Law-enforcement pressure increased but has not stopped the activity. Europol's Operation Eastwood (July 2025) took more than 100 NoName057(16) servers offline and produced two arrests and seven arrest warrants; Imperva measured a few days of silence followed by a higher attack tempo [9][10]. NoName057(16) remained the most active DDoS-claiming group through the first half of 2026 [19]. The United States extradited and indicted one alleged CARR and NoName057(16) participant, Spain arrested an alleged supporter, and Dutch investigators seized 800 servers from hosting companies linked to the group's infrastructure [11][14][15].

Most hacktivist operations still have limited effect, and the groups routinely exaggerate. The joint advisory says pro-Russian groups have limited capabilities and regularly make false or exaggerated claims [12]. The exception is tampering with internet-exposed operational technology (OT). Confirmed cases now include burst water pipes in Denmark, a dam valve opened in Norway, and manipulated water pressure in Canada, all achieved through weak or default credentials rather than sophisticated tooling [13][21][22]. Anonymous Sudan remains disrupted following the October 2024 US indictment; no later activity was found in this refresh.

Key Actors

Current Activity

NoName057(16) After Operation Eastwood (2025-2026)

NoName057(16) claimed 4,693 attacks in 2025 according to Radware, and generated 40.5% of all recorded hacktivist DDoS claims in the first half of 2026 [19][20]. Operation Eastwood in mid-July 2025 disrupted its infrastructure, but Imperva recorded a rise from about 10 to about 18 targeted sites per day once the group resumed on 23 July, with nearly half of the subsequent attacks aimed at German websites [10]. The group continued to time campaigns to political events. It carried out DDoS attacks on Danish political party websites ahead of the November 2025 municipal and regional elections, which Denmark attributed to it [13]. It claimed attacks on about 120 Italian targets, including foreign ministry sites and hotels in Cortina d'Ampezzo, before the February 2026 Winter Olympics; Italy's foreign minister said the attacks were thwarted and reporting indicated no significant disruption [29]. On 2 March 2026 the group declared solidarity with Iran and began claiming Israeli targets [16].

Pro-Russian OT Tampering

The joint advisory AA25-343A (9 December 2025) describes CARR, NoName057(16), Z-Pentest and Sector16 scanning for internet-facing VNC services, brute-forcing weak or default passwords, and then changing settings on human-machine interfaces. Targets are mainly water and wastewater, food and agriculture, and energy. The most common effect is a temporary loss of view that forces manual operation; the advisory states that attacks have not yet caused injury [12]. Confirmed or officially attributed cases:

• Denmark: the Defence Intelligence Service attributed a destructive 2024 attack on a water utility to Z-Pentest [13]. Press reporting describes manipulated pressure and households left without water for several hours [30].
• Norway: on 7 April 2025 an attacker opened a valve at the Bremanger dam for about four hours through a web-accessible control panel protected by a weak password. No damage resulted. The head of the Police Security Service attributed it to pro-Russian cyber actors in August 2025 [21].
• Canada: alert AL25-016 (29 October 2025) reported tampering with water pressure at a water facility, a manipulated tank gauge at an oil and gas company, and altered temperature and humidity in a grain silo. It named no group [22]. Separately, the Communications Security Establishment reported that NoName057(16) claimed control of a Quebec municipal water treatment plant in October 2025; the claim is unconfirmed [31].
• United States: the Department of Justice alleges CARR attacks on drinking water systems in several states and on a Los Angeles meat processing facility in November 2024 that spoiled thousands of pounds of meat and triggered an ammonia leak [11].

Forescout showed how unreliable claims can be: TwoNet publicly claimed an attack on a water utility that was in fact a Forescout honeypot, entered with default credentials [24].

Middle East: June 2025 and the 2026 Iran Conflict

During the June 2025 Israel-Iran exchange, Predatory Sparrow claimed to have destroyed data at Iran's Bank Sepah. IRGC-linked Iranian media reported disrupted account access, withdrawals and card payments [28].

After the US and Israeli strikes of 28 February 2026, Radware counted 149 hacktivist DDoS claims against 110 organizations in 16 countries in the first three days, with Keymous+, DieNet and NoName057(16) responsible for about three quarters of them and Kuwait, Israel and Jordan the most targeted [32]. Unit 42 counted about 60 active groups by 2 March and described an "Electronic Operations Room" set up on 28 February to coordinate Iran-aligned personas [17]. Pro-Russian groups joined in: Z-Pentest claimed control of Israeli water and pump systems, and Cardinal and Russian Legion claimed breaches of Iron Dome systems [16][17]. None of these claims was independently verified. Intel 471 assessed that the surge was real but that the groups frequently exaggerate impact [16].

The most consequential incident associated with a hacktivist persona in this period is Stryker. The company disclosed on 12 March 2026 that an incident identified on 11 March caused a global disruption to its Microsoft environment and disrupted order processing, manufacturing and shipping [18]. Handala claimed responsibility, including device wiping and data theft. Stryker did not attribute the incident, and the method and the data theft claim remain unverified [33].

Pro-Ukrainian Operations

Russian vendor F6 reported in March 2025 that IT Army of Ukraine DDoS activity had risen sharply over the previous year, with a focus on regional telecom operators in Kursk and Belgorod [26]. Kaspersky reported in September 2026 that Hacking Cat had moved from leaks and defacement to encryption and data destruction, working alongside Ukrainian Cyber Alliance and Cyber Anarchy Squad. Hacking Cat disputed part of that attribution [27].

Historical Events

TTP Evolution

DDoS Capabilities: Hacktivist DDoS has evolved from basic volumetric attacks using off-the-shelf tools (LOIC, HOIC) to sophisticated Layer 7 application-layer attacks using commercial stresser services, botnets, and custom tools. Anonymous Sudan utilized cloud infrastructure and SaaS DDoS platforms to generate attacks exceeding 1 Tbps. NoName057(16)'s DDoSia represents a gamified crowdsourcing model. Some groups rent or operate botnets for sustained campaigns. The March 2025 attack on X was carried mostly by compromised IP cameras and video recorders, whoever directed it [34].

From DDoS to Data: More capable groups have moved beyond DDoS to data exfiltration and publication. SiegedSec specialized in data leaks targeting organizations based on political stance. Some pro-Russian groups have leaked data from Ukrainian organizations. Z-Pentest favors hack-and-leak and defacement over DDoS [12]. The transition from "disruption" to "exposure" hacktivism increases potential impact and intelligence value.

ICS/OT Targeting: OT tampering has moved from occasional claims to a recurring, government-documented pattern. The method remains simple: scan for exposed VNC or web panels, brute-force weak or default credentials, and change values through the operator interface. The joint advisory calls the approach unsophisticated, inexpensive and easy to replicate, and notes that the actors often misunderstand the processes they alter, which makes outcomes unpredictable [12]. Cyber Av3ngers specifically targeted Unitronics Vision PLC devices in 2023. A joint US advisory of April 2026 (updated July 2026) describes Iranian-affiliated actors manipulating Rockwell Automation, and later Schneider Electric and Siemens, PLCs with operational disruption and financial loss in some cases [23].

State-Aligned Operations: The most significant TTP evolution is the use of hacktivist branding as a facade for state-directed operations. This provides plausible deniability, enables more aggressive operations without direct attribution to intelligence services, and leverages volunteer participants as unwitting proxies. US authorities allege that a moniker associated with at least one GRU officer instructed CARR leadership on target selection, and that CISM staff built DDoSia, paid for infrastructure and picked targets for NoName057(16) [11][12].

Ransomware Crossover: Some hacktivist groups have adopted ransomware or wiper tactics. GhostSec partnered with Stormous ransomware. Groups have deployed wipers against Ukrainian targets under hacktivist banners. Kaspersky reports pro-Ukrainian groups using ransomware and wipers against Russian organizations, and notes shared custom tooling across several groups [27]. This convergence of hacktivist motivation with criminal tooling blurs traditional categorization.

Mercenary Drift: KillNet's brand was sold after its founder was exposed, and analysts now describe it as a hack-for-hire operation driven by money rather than ideology [25].

Ecosystem & Infrastructure Patterns

Telegram as Command-and-Control: Telegram is the primary coordination platform for modern hacktivism. Groups use channels for target announcements, attack coordination, proof-of-impact screenshots, and recruiting. During Operation Eastwood, authorities used the same channel in reverse, messaging 1,100 participants and 17 administrators to warn them of criminal liability [9].

Geopolitical Alignment Clustering: The hacktivist landscape clusters along geopolitical lines: Pro-Russia (NoName057(16), CARR, Z-Pentest, Sector16) + Pro-Iran (Handala, Cyber Av3ngers, Homeland Justice) + some pro-Palestine groups form one axis. Pro-Ukraine (IT Army of Ukraine, Ukrainian Cyber Alliance, various) + anti-Iran groups form another. The March 2026 surge showed the first axis acting together, with pro-Russian groups claiming Israeli targets within days of the strikes on Iran [16][17].

Brand Churn: Groups splinter, rebrand and revive old names. Z-Pentest grew out of CARR and NoName057(16); Sector16 grew out of Z-Pentest; TwoNet appeared, closed, returned and closed again within a year [12][24]. Track people and infrastructure rather than names.

Crowdsourcing Models: NoName057(16)'s DDoSia and Ukraine's IT Army both use crowdsourcing — distributing target lists and tools to volunteers via Telegram, enabling large-scale operations without centralized infrastructure. DDoSia incentivizes participation with cryptocurrency payments, creating a paid volunteer model.

Hosting Dependencies: Pro-Russian operations depend on commercial hosting. The EU sanctioned Stark Industries in May 2025, and in May 2026 Dutch investigators seized 800 servers from companies alleged to have continued its business [15].

Attribution Challenges: Distinguishing genuine grassroots hacktivism from state-directed operations is extremely difficult. Indicators of state alignment include: operational sophistication exceeding stated capability, targeting aligned precisely with state foreign policy objectives, infrastructure overlapping with known state actors, and operational security inconsistent with volunteer groups.

Tooling

Intelligence Gaps

• State direction vs. alignment: Governments have now stated the origin of CARR and NoName057(16), but the degree of day-to-day tasking is unclear, as is the position of smaller brands. The advisory says only that Sector16 members may have received indirect support from the Russian government [12].
• CARR and Z-Pentest relationship: Sources disagree. The Department of Justice describes CARR as "also known as Z-Pentest"; the joint advisory describes Z-Pentest as a separate group formed by CARR and NoName057(16) administrators in September 2024 [11][12].
• Dubranova case outcome: Trials were scheduled for 3 February 2026 (NoName057(16)) and 7 April 2026 (CARR). No verdict, plea or sentence was found in this refresh [11].
• Anonymous Sudan case outcome: No trial, plea or sentencing information was found, and no renewed activity under the name.
• Stryker attribution: Handala's claim, the intrusion method and the alleged data theft are unverified by the company [18][33].
• 2026 PLC campaign actor: The joint advisory attributes the activity to Iranian-affiliated APT actors and mentions Cyber Av3ngers only as the source of similar earlier activity. Unit 42 tracks the Rockwell targeting as a cluster it associates with Cyber Av3ngers [17][23].
• SiegedSec, GhostSec, RipperSec: Status was not independently re-verified. RipperSec appears in vendor reporting on the March 2026 surge as part of a wider collective [17].
• IT Army of Ukraine tempo in 2026: The latest sourced assessment dates from March 2025 and comes from a Russian vendor [26].
• Actual DDoS impact: Most hacktivist groups self-report their impact through screenshots of error pages or downtime monitors. Vendor counts of "claimed attacks" measure claims, not outages.
• ICS/OT claims verification: Many hacktivist ICS claims are exaggerated or fabricated, as the TwoNet honeypot case shows. Verifying which claims represent genuine compromises remains essential but difficult.
• Financial flows: US authorities allege GRU funding of CARR tools through at least September 2024 and that dissatisfaction with that funding led to Z-Pentest [12]. Funding of other groups is not well understood.

Sources & References

1. US DOJ - "Two Sudanese Nationals Indicted for Anonymous Sudan DDoS Attacks" (October 2024) — https://www.justice.gov/
2. CISA - "IRGC-Affiliated Cyber Actors Exploit PLCs" Advisory (December 2023) — https://www.cisa.gov/
3. Mandiant - "Hacktivism and State-Aligned Operations Analysis" — https://www.mandiant.com/resources
4. CrowdStrike - "Hacktivist Landscape Reports" — https://www.crowdstrike.com/
5. Radware - "Hacktivism Unveiled" reports — https://www.radware.com/
6. Flashpoint - "Pro-Russian and Pro-Ukrainian Hacktivist Tracking" — https://flashpoint.io/
7. Microsoft - "Storm-1359 (Anonymous Sudan) Analysis" — https://www.microsoft.com/en-us/security/blog/
8. Orange Cyberdefense - "Cy-Xplorer Reports on Hacktivism" — https://www.orangecyberdefense.com/
9. BleepingComputer - "Europol disrupts pro-Russian NoName057(16) DDoS hacktivist group" (16 July 2025), reporting the Europol announcement — https://www.bleepingcomputer.com/news/security/europol-disrupts-pro-russian-noname05716-ddos-hacktivist-group/
10. Imperva - "Operation Eastwood: Measuring the Real Impact on NoName057(16)" (September 2025) — https://www.imperva.com/blog/operation-eastwood-measuring-the-real-impact-on-noname05716/
11. US DOJ - "Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal Hacking Groups" (9 December 2025) — https://www.justice.gov/opa/pr/justice-department-announces-actions-combat-two-russian-state-sponsored-cyber-criminal
12. CISA, FBI, NSA and partners - "Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure", AA25-343A (9 December 2025, revised 18 December 2025) — https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a
13. Danish Defence Intelligence Service - "Russia is responsible for destructive and disruptive cyber-attacks against Denmark" (18 December 2025) — https://www.fe-ddis.dk/globalassets/fe/dokumenter/2025/-russia-responsible-for-cyber-attacks-.pdf
14. The Record - "Spain arrests alleged supporter of pro-Russian hacktivist groups after FBI tip" (8 July 2026) — https://therecord.media/spain-arrest-alleged-supporter-noname-carr-zpentest
15. BleepingComputer - "Netherlands seizes 800 servers of hosting firm enabling cyberattacks" (22 May 2026) — https://www.bleepingcomputer.com/news/security/netherlands-seizes-800-servers-of-hosting-firm-enabling-cyberattacks/
16. Intel 471 - "Israeli, US strikes against Iran triggers a surge in hacktivist activity" (9 March 2026) — https://www.intel471.com/blog/israeli-us-strikes-against-iran-triggers-a-surge-in-hacktivist-activity
17. Palo Alto Networks Unit 42 - "Threat Brief: Escalation of Cyber Risk Related to Iran" (updated 17 April 2026) — https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/
18. Stryker Corporation - Form 8-K (filed 12 March 2026) — https://www.sec.gov/Archives/edgar/data/310764/000119312526104431/d101097d8k.htm
19. Radware - "H1 2026 Global Threat Report" press release (9 September 2026) — https://www.globenewswire.com/news-release/2026/09/09/3358409/8980/en/radware-h1-2026-global-threat-report-shows-web-ddos-attacks-jump-more-than-110-as-cyber-threats-accelerate.html
20. Radware - "2026 Global Threat Report" press release (19 February 2026) — https://www.globenewswire.com/news-release/2026/02/19/3240861/8980/en/radware-2026-global-threat-report-shows-ddos-attacks-jump-168-as-cyber-threats-escalate-across-networks-and-applications.html
21. NATO CCDCOE Cyber Law Toolkit - "Cyber incident against the Bremanger dam in Norway (2025)" — https://cyberlaw.ccdcoe.org/wiki/Cyber_incident_against_the_Bremanger_dam_in_Norway_(2025)
22. Canadian Centre for Cyber Security - "AL25-016 Internet-accessible industrial control systems (ICS) abused by hacktivists" (29 October 2025) — https://www.cyber.gc.ca/en/alerts-advisories/al25-016-internet-accessible-industrial-control-systems-ics-abused-hacktivists
23. CISA, FBI, NSA and partners - "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure", AA26-097A (7 April 2026, updated 22 July 2026) — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
24. Forescout - "Anatomy of a Hacktivist Attack: Russia-Aligned Group Targets OT/ICS" (9 October 2025) — https://www.forescout.com/blog/anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics/
25. The Record - "Russian hacker group Killnet returns with new identity" (22 May 2025) — https://therecord.media/russian-hacker-group-killnet-returns-with-new-identity
26. The Record - "Ukraine's IT Army keeps up attacks on Russia despite waning media hype" (19 March 2025) — https://therecord.media/it-army-keeps-up-attacks-on-russia-ukraine
27. The Record - report on Kaspersky research into Hacking Cat (14 September 2026) — https://therecord.media/ukraine-malware-russia-ransomware
28. The Record - "Pro-Israel hackers claim breach of Iranian bank amid military escalation" (17 June 2025) — https://therecord.media/pro-israel-hackers-claim-attack-on-iranian-bank
29. The Record - "Italy blames Russia-linked hackers for cyberattacks ahead of Winter Olympics" (5 February 2026) — https://therecord.media/italy-blames-russia-linked-hackers-winter-games-cyberattack
30. The Record - "Denmark summons Russian ambassador over alleged cyberattacks on water utility, elections" (19 December 2025) — https://therecord.media/denmark-summons-russian-ambassador-cyberattack-elections
31. GovInfoSecurity - "Russian Water System Hack Attempted to Turn Canada Dry" (30 June 2026), reporting the CSE annual report 2025-2026 — https://www.govinfosecurity.com/russian-water-system-hack-attempted-to-turn-canada-dry-a-32122
32. The Hacker News - "149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict" (March 2026), reporting Radware data — https://thehackernews.com/2026/03/149-hacktivist-ddos-attacks-hit-110.html
33. Arctic Wolf - "Stryker Systems Disrupted in Cyber Attack; Handala Group Claims Responsibility" (13 March 2026) — https://arcticwolf.com/resources/blog/stryker-systems-disrupted-cyber-attack-handala-group-claims-responsibility/
34. Bitsight - "Massive DDoS on X: Dark Storm or Cyber Fog?" (14 March 2025) — https://www.bitsight.com/blog/massive-ddos-x-dark-storm-or-cyber-fog

Change Log