NoName057(16) DDoS Alert: 10 French Maritime and Defense Sites

A new NoName057(16) DDoS campaign put ten French websites on a public target list on October 17, 2026. The names run from departmental and city portals to a port authority page, maritime freight operators, an explosives manufacturer and a drone developer. Every entry comes with a check-host.net report link, and the post closes with the tags #TimeOfRetribution and #OpFrance.

The screenshot does not show whether any of the ten services actually went offline, and this report treats that gap carefully.

What the NoName057(16) Post Says

The message appeared on the group’s public channel with a 14:29 timestamp. The author says the group is “smashing French websites” across public administration, transport, maritime and the military-industrial complex, and adds a devil emoji. A 32-second video accompanies the text. Its thumbnail shows a hooded figure at a laptop in front of the Eiffel Tower, beside a French flag crossed out in red.

When captured, the post showed 247 views and one heart reaction, and it was marked as edited. That is a small audience, but reach has never been the point. Europol describes a network of sympathisers who run automated attack tools on the group’s behalf, so a short list can become real traffic once followers act on it.

Ten Targets in the NoName057(16) DDoS Campaign

Here is how the post labels each entry.

Entry as labeled in the post :

1. Department of Vienne (closed by geo)
2. Department of Gers (closed by geo)
3. City of Brest (closed by geo)
4. Eurenco explosives manufacturer
5. Genavir Research Fleet
6. Compagnie Maritime Nantaise (CMN) Maritime Freight
7. CMN Portal
8. Port Atlantique La Rochelle Authorization
9. Portal of the Corsica Linea Professional Maritime Training Center
10. XSun UAV development

Three entries, Vienne, Gers and Brest, carry the note closed by geo. The wording points to geo-blocking, where a site refuses visitors from outside a set of countries. If so, the check-host probes may have been turned away by a filter and not knocked offline by traffic, which is a very different outcome.

Why the Maritime and Defense Names Stand Out

Seven of the ten entries sit outside ordinary local government. Eurenco makes explosives and energetic materials, Genavir runs a research fleet, and XSun is a solar drone developer from the Loire-Atlantique area. The rest are maritime names: a freight operator that appears twice, a port authority page and a training center portal.

Most look like public front doors, such as login portals, training sites and information pages. That is the usual choice for a DDoS because the pages are easy to reach and easy to measure. A flooded portal can frustrate staff, trainees and customers. It does not mean the explosives plant, the research ships or the drone program were touched.

NoName057(16) After Operation Eastwood

This is not a new actor. Europol and Eurojust coordinated Operation Eastwood between July 14 and 17, 2025, with authorities from a dozen countries. Europol said the action disrupted an attack network of more than 100 computer systems and knocked a large part of the group’s central servers offline. There were two arrests, one in France and one in Spain, and seven arrest warrants in total. The agency’s own account is on the Europol newsroom.

One hashtag in the new post is partly masked, but it ends in F*ckEastwood, which reads like a nod to that operation. The group has also kept working. On October 8, 2026, Italy’s foreign ministry reported that it had contained a DDoS wave against its website with no outage, and Italian press linked the activity to the same group. France was hit before, including a wave against municipal websites on December 31, 2024. Earlier coverage: related CyberAsia.io report on pro-Russian DDoS campaigns.

How to Read a check-host.net Report

Each entry points to a check-host.net report, a free tool that tests whether a host answers from probes in many countries. A failed result means a probe got no answer or an error at that moment, and it does not say why. Heavy traffic, a foreign-IP filter and scheduled maintenance can all look the same. A report is also a snapshot, so it cannot show how long a problem lasted or whether a content delivery network absorbed the load minutes later. The links work better as publicity for the campaign than as proof of impact.

What IT Teams Should Do Now

Teams that run similar public portals can use this list as a prompt for a quick review.

• Check edge and web server logs around the post time. Look for spikes in Layer 7 requests, repeated hits on one login or search path, and one URL requested from many addresses.
• Put rate limits and bot challenges on login, search and form endpoints, and cache every page that can be cached.
• Confirm with the CDN or DDoS protection provider that mitigation covers every public hostname, including forgotten training and authorization portals.
• Review geo-blocking rules so partners and remote staff are not locked out.
• Keep a short status message ready for staff and customers, and report incidents to CERT-FR.

What Remains Open

The post gives no traffic volume, no duration and no sign of data access. None of the named organizations speaks in it. The tags suggest the group expects to continue under #OpFrance, and CyberAsia.io will update this report if the organizations or French authorities publish details about the NoName057(16) DDoS activity.

FAQ

Q1 : Does a DDoS attack on these sites mean data was stolen?

No. A DDoS floods a service with requests so that it slows down or stops answering. It does not by itself give attackers access to databases, mail or internal systems, and nothing in the post points to data theft. Organizations should still review logs, because a flood can sometimes cover other activity.

Q2 : What can a smaller organization do against a wave like this?

Put the site behind a CDN with DDoS protection, cache static pages, and rate limit login and search paths. Agree in advance with the hosting provider on who acts when traffic spikes.

Q3 : Is NoName057(16) still active after Operation Eastwood?

The evidence says yes. The October 17 post targets France, and Italy’s foreign ministry reported a DDoS wave against its website on October 8. The 2025 operation disrupted the group’s infrastructure, but it did not end the activity.

Research Notice

This article is published for cybersecurity education and awareness. It draws on a screenshot of a public post by a threat group and on public reporting. CyberAsia.io does not endorse or encourage any attack, and none of the listed organizations has been shown to be compromised. Readers should consult official sources for confirmation of any incident.