MalwarePublished 16 Dec 2025Updated 15 Jan 2026

Investigating the Infrastructure Behind DDoSia's Attacks

Source AlienVault OTX General

Description

DDoSia, a participatory DDoS tool created by Russian hacktivists in 2022, is operated by the pro-Russian group NoName057(16). It relies on volunteers to contribute network resources for attacks, primarily targeting Ukraine, European allies, and NATO states. Censys has monitored DDoSia since mid-2025, observing an average of 6 control servers with short lifespans. The tool uses a multi-layered control infrastructure, with systems typically hosted on VPS providers. Despite law enforcement disruption in July 2025, DDoSia quickly reconstituted and resumed operations. The infrastructure is characterized by rapid changes, with most servers active for less than 24 hours. Attacks focus on government, military, transportation, public utilities, financial, and tourism sectors.

Impact

For European organizations, the DDoSia threat poses significant risks primarily through service disruption. Targeted sectors such as government, military, transportation, public utilities, financial services, and tourism are critical to national security and economic stability. Successful DDoS attacks can degrade or deny access to essential services, causing operational downtime, financial losses, reputational damage, and potential cascading effects on public safety and national defense. The rapid infrastructure turnover and resilience of DDoSia complicate mitigation and response efforts, increasing the likelihood of sustained or repeated attacks. European allies and NATO members face heightened risk due to the geopolitical motivations behind the attacks. The threat could also strain incident response resources and necessitate increased investment in DDoS mitigation technologies and cross-border cooperation. While the attacks do not directly compromise data confidentiality or integrity, the availability impact alone can have severe consequences for critical infrastructure and government operations.

Defensive guidance

European organizations should implement advanced DDoS mitigation strategies tailored to the evolving tactics of DDoSia. This includes deploying scalable, cloud-based scrubbing services capable of absorbing large volumetric attacks and filtering malicious traffic in real time. Network segmentation and redundancy can limit the impact on critical systems. Organizations should establish robust traffic monitoring and anomaly detection to identify early signs of DDoS activity, leveraging threat intelligence feeds that include indicators related to DDoSia infrastructure. Collaboration with national CERTs, ISPs, and international partners is essential for rapid information sharing and coordinated response. Given the short lifespan of control servers, continuous monitoring of VPS providers commonly abused by DDoSia can aid in proactive takedown requests. Incident response plans must be updated to address prolonged or repeated DDoS campaigns, including communication strategies for stakeholders and customers. Finally, organizations should conduct regular resilience testing and staff training to ensure preparedness against multi-vector DDoS attacks.

Indicators of compromise

IP addresses 126

103.136.69.227
103.231.75.120
103.80.86.26
103.80.86.66
104.194.143.96
104.194.145.88
104.194.149.73
104.194.149.9
104.194.150.61
109.120.150.76

Hashes 37

62ade05e4d0f72b4aeffa5c774b856e5
0d5cac778ec1f9a1471e0d78742d3fe9
350080807089685338364348e6419122
6729b380cef552f90c299e6dcfc3d6ef
6eef15654dd0310a0e3b440530ec0a9e
7c1eccb1ad0747158a09b251531d87b6
7e303ba87dc7d1bfe876b6db09a55a09
853ead0d757435ca8dcdbb37ffa781c6
879719a084c1923e0ca5865c4a4a66dc
b0b210e7c42a5423f51facac60afddfb

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Dec 2025, 12:55 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

IP addresses 126

Hashes 37

Community reviews

Related threats