France's maritime sector was placed on alert on 14 October after M-CERT, the cyber incident response centre for ports and shipping, warned that pro-Russian hacktivist group NoName057(16) was targeting the industry with distributed denial-of-service attacks.
In an email sent to ports and shipowners, M-CERT wrote: "We have thus discovered that the French maritime and port sector is currently being targeted by the pro-Russian hacktivist group NoName057(16). The attacks (DDoS) are ongoing or likely to be launched imminently." The message, which contained a typo rendering the group's name as "NoName557(16)", recommended that affected companies contact the maritime gendarmerie. A screenshot of the alert was published on X by Seb La Tombe, founder of French Breaches, an account specialised in data leak analysis followed by more than 100,000 people.
On its Telegram channel, NoName057(16) listed its targets as Marfret, Compagnie Maritime Nantaise, Genavir, the Grand Port Maritime de Marseille and Port Atlantique La Rochelle. None of the named organisations confirmed any disruption.
A crowdsourced attack model paid in TON
What distinguishes NoName057(16) from other hacktivist outfits is its recruitment system, detailed since the summer by Polish outlet Vot Tak. The group calls on volunteers to lend their computing power to its DDoSia tool, available on Windows, Linux, macOS, Android and routers, framing participation as a "patriotic online game" complete with military ranks running up to "General Dosi".
Volunteers are paid in dCoins: 500,000 successful requests in a single day earns 50 dCoins, each worth around 2 rubles, roughly 2.4 cents. A full day of service is worth about $1.20. The dCoins are converted into TON, the cryptocurrency native to the Telegram ecosystem, before being turned into cash — a route that bypasses banking circuits already closed to Russians following the sanctioning of exchange Garantex. Telegram's chief executive was arrested in France in 2024.
Europol's crackdown had limited effect
In July 2025, Europol dismantled part of the group's infrastructure in Operation Eastwood, a coordinated action across twelve countries that took down more than 100 servers, carried out 24 searches, made two arrests in France and Spain, and issued seven arrest warrants. Five Russians, including Mikhail Burlakov and Maxim Lupin, were added to the EU's most wanted list; Europol describes them as coordinators of the group and leaders of a Russian public organisation, accusations both men deny. Europol estimated the group's pool at more than 4,000 sympathisers, of whom over a thousand received warnings about criminal responsibility, and described the recruitment pitch as a "playful manipulation" exploiting a "feeling of status".
Activity nonetheless persisted. Vot Tak recorded around 6,300 attack orders per month before Eastwood, rising to about 7,700 afterwards. Between late October 2025 and mid-March 2026, the group claimed 1,530 operations, with government websites accounting for nearly a third of targets, ahead of finance and transport. Germany was hit in retaliation, Denmark was targeted during its November municipal elections, and France itself was struck on 22 December, affecting La Poste, La Banque Postale and several regional airports.
Analyst Leonid Yuldashev estimates that 80 percent of targeted sites carry anti-DDoS protection, and Poland's Ministry of Digital Affairs describes the resulting damage as limited. In December 2025 the US Department of Justice brought charges against alleged members of the group. Payments, meanwhile, continue to flow through Telegram and TON.
