NoName057(16) DDoS Campaign Targets German Ferry and City Services

A coordinated NoName057(16) DDoS campaign disrupted multiple public digital portals in Germany. The pro-Russian hacktivist collective claimed responsibility for taking several administrative and public-service domains offline. Named targets include municipal systems in Wiesbaden and the ferry operator TT-Line.

This activity fits a sustained pattern of geopolitical retaliation by NoName057(16) against European countries whose foreign policy the group opposes. The group used its crowdsourced botnet to run high-volume Layer 7 floods that overwhelm HTTP and HTTPS handling on the origin.

Technical Analysis / Attack Method

Attack telemetry points to continued use of DDoSia, a custom Golang toolkit that NoName057(16) distributes to volunteer participants over Telegram. The toolkit instructs volunteer or infected nodes to request heavy resources from targeted endpoints repeatedly. Operators rotate residential proxies and spoof user-agents dynamically to bypass basic rate limiting. The latest strike produced prolonged Connection Timed Out errors across several municipal domains.

Target Infrastructure

Botnet Architecture and Crowdsourcing

NoName057(16) depends on DDoSia to run a scalable, crowdsourced botnet. Sympathizers install the payload on personal machines and become attack nodes. The toolkit talks to primary command-and-control servers over Telegram and receives target lists, attack parameters, and execution timelines in real time. That decentralized design makes attribution and infrastructure takedowns difficult for law enforcement.

The group gamifies participation with financial incentives and public leaderboards on Telegram. That model keeps a supply of fresh IP addresses flowing, which undermines simple IP-based rate limits and basic firewall rules. DDoSia is updated often and supports HTTP floods, Slowloris-style attacks, and TLS handshake exhaustion.

Critical Infrastructure Impact

Attacks on municipal and transport services, including German ferry networks, create effects beyond a website outage. Ticketing systems fail. Real-time schedule updates stop reaching commuters. Backend logistics coordination is disrupted. People who rely on these services for daily travel feel the impact immediately.

Threat actors use that public friction and the media coverage that follows to amplify a geopolitical message. Municipal IT teams need enterprise-grade perimeter defenses for these nodes, including BGP Anycast for traffic distribution and geographic filtering of requests from unexpected regions.

NoName057(16) has used this same DDoSia pattern against other European public services. The German ferry and Wiesbaden pairing is one card in that series. Measure your own edge. If TT-Line or the city portals are in your dependency map, you already know the playbook: challenge, rate-limit, Anycast, and a status page that does not live on the same origin. The volunteer botnet will still exist tomorrow. The only question is whether your origin is still the cheapest one on their list.

Mitigation and Prevention Strategies

For municipal and ferry IT.

• Web application firewall. Challenge suspicious inbound traffic with CAPTCHA or JavaScript checks to drop automated DDoSia requests.
• Aggressive rate limits on HTTP GET and POST per IP.
• Geo-challenge for services that only serve a domestic audience, including library catalogs. Challenge foreign IPs and known proxy exits.
• BGP Anycast and origin shielding so a flood cannot pin a single host.

How DDoSia Stays Hard to Take Down

Because volunteers bring their own PCs, the visible source addresses change every wave. Blocking yesterday’s /24 does not stop tonight’s leaderboard. Telegram carries the targeting, not a single VPS you can seize. Law enforcement can disrupt a channel. They cannot seize every laptop that ran the binary. That is why municipal edges need behaviour (challenge, rate, Anycast), not a static deny list of last month’s nodes.

The ferry and city pairing is deliberate. A transport login and a housing office are both citizen-facing HTTP. They are not classified networks. They are the services people notice at 8am. That notice is the point of the campaign. Treat the claim of responsibility as a claim. Treat the timed-out portals as an availability incident you can measure on your own edge.

For residents.

• Do not refresh a downed municipal page repeatedly. Extra legitimate requests add load. Wait for an official update.

Disclaimer: CyberAsia is an independent Cyber Threat Intelligence (CTI) research organization. The information provided in this report is derived from public intelligence gathering, dark web monitoring, and threat actor claims. It is published strictly for educational purposes, defensive analysis, and public awareness. CyberAsia does not endorse, verify, or facilitate any cyberattacks or illegal activities.