Pro-Russian Hackers Turn Web Outages Into Psychological Warfare

A government website goes dark for a few hours. Staff scramble, a help desk fields angry calls, and by evening the service is back up. Nothing was stolen, nothing was altered, and on paper the damage looks minor. That is exactly the read a new case study wants readers to reject.

According to the analysis, the outage was never really the objective for NoName057(16), a pro-Russian hacktivist collective that has repeatedly targeted Finland and other members of the North Atlantic Treaty Organization (NATO), plus assorted European states. The disruption is the opening act of a longer campaign meant to chip away at public confidence in the governments and institutions it hits.

NoName appeared within days of Russia’s full-scale invasion of Ukraine in 2022, and it has been busy since. The case study, drawing on more than 20 documents, including government advisories, industry threat reports and prior research, plus direct review of the group’s own Telegram and Teletype channels, counts more than 1,500 distributed denial of service attacks by June 2025, most aimed at countries seen as hostile to Russian interests. Since Finland joined NATO, the tempo there has climbed sharply: 23 rounds of attacks since the start of 2025 alone hit 129 public and private organizations, from the national parliament to municipal offices and banks. A distributed denial of service attack works by flooding a target’s servers with junk traffic from many machines at once, until legitimate visitors cannot get through.

Hacktivism is usually filed under nuisance rather than serious threat. The researchers push back on that instinct.

Their argument rests on how the group is built, not just on what it breaks. NoName recruits through Telegram and Teletype, distributing a custom denial-of-service tool called DDoSia through a bot that handles sign-ups, and it instructs new members on installing the software, sometimes advising them to disable their own antivirus protection to avoid conflicts, a step the authors flag as a classic defence-evasion tactic. What makes the operation unusual is what happens after someone joins: active participants can earn cryptocurrency payouts of up to $1,200 for a successful run.

“They claim to be hacktivists but they have an incentive system more common for cyber criminals,” says Hadi Ghanbari, an assistant professor at Aalto University School of Business who led the study.

That payment structure is what pulls NoName out of the tidy categories cybersecurity teams tend to use. The paper sorts attackers into four familiar buckets: cybercriminals chasing money, state-sponsored hackers chasing geopolitical advantage, hackers-for-hire selling their skills to clients, and hacktivists chasing a cause. NoName, the authors argue, borrows from three of the four at once: the ideology and propaganda instincts of a hacktivist group, the piecework payments of a hacker-for-hire operation, and alliances with at least one collective German investigators have linked to the Russian cyber army. The group has also formed a joint offshoot, Z-Pentest, with one of those allies, and it has struck well beyond Europe, hitting more than 50 Taiwanese organizations in a single 2024 campaign and, more recently, Israeli targets in solidarity with Iran.

“It’s easy to focus on the financial costs, but the more hidden risk is if people lose confidence in large organisations or government services, then the next step is for them to ask what’s the point of having them,” Ghanbari says.

A Manifesto Written for Volunteers, Not Just Enemies

Most of what is known about NoName’s inner workings comes from the group itself, and the authors treat that fact carefully throughout the case. Its manifesto, posted on the minimalist publishing platform Telegraph, casts the group as defending Russian values on what it calls an information front, and its recruitment materials read less like propaganda than a product pitch: install instructions in six languages, a rewards program paid out in a proprietary token called dCoin, and a target list published in advance on a channel the authors call the DDoSia Target Monitor. One recruiting post goes so far as to reassure Russia-based volunteers that the software is framed, legally, as a stress-testing tool and that legal risk there is minimal, a claim the authors read as a deliberate hint at tolerance, if not protection, from Russian authorities. Whether the group receives state funding, or any funding beyond its own uncertain revenue, is left unresolved. A separate claim that NoName ran a phishing scheme impersonating the Polish government to harvest payment details could not be verified by the authors.

The uncertainty around funding does not blunt the concern the authors raise about response. Because NoName is waging what it frames as psychological warfare, the case argues that a purely technical fix, restoring the server and moving on, hands the group exactly the silence it wants. That framing echoes a 2025 assessment from the EU’s own cybersecurity agency, which found that hacktivist DDoS campaigns against European public administrations aim at undermining confidence in institutions as much as at the outage itself.

Law enforcement has already tried the purely technical route. In July 2025, a Europol-coordinated operation called Eastwood disrupted more than 100 of the group’s servers and led to arrest warrants for six people in Russia, according to Europol’s own statement. NoName’s Telegram channel dismissed the operation days later and kept publishing target lists, which is exactly the resilience the case study would predict from a network built to survive the loss of any single node.

Why the Silence After an Attack Is Costly

“The point is to escalate the psychological cost of their actions. It’s a complex game. Companies and governments can play into the hackers’ hands if they’re not transparent,” Ghanbari says. The case study recommends that technical and communications teams coordinate from the first hour of an incident, so that a factual account of what happened reaches the public before the group’s own channels get to frame it first.

The authors are careful not to inflate a website outage into an act of war. Their point is narrower: an outage becomes something larger the moment an attacker treats it as a stage rather than a goal, and Finland’s Parliament, its banks and its municipalities have been standing on that stage since 2023. “Not only does it undermine their basic rights, it also undermines the ideological system that underpins them,” Ghanbari says of the citizens caught in the middle. The next country to notice the pattern, the case suggests, is likely to be whichever one Moscow decides, next, counts as an enemy.

FAQ