A dollar a day to attack Europe. And this week, the target is French. On Wednesday October 14, M-CERT, the maritime sector's cyber incident response center, alerted ports and shipowners of ongoing or imminent DDoS attacks. Behind the offensive, the pro-Russian collective NoName057(16). His model? Volunteers paid in crypto to lend their computers, with military ranks and rankings to spice things up.
An investigation by the Polish media Vot Tak has detailed this operation since this summer. She describes a recruiting machine that runs on Telegram, the application whose boss was arrested in France in 2024.
Key Points
M-CERT alerts the French maritime sector on October 14. The group claims targets such as the port of Marseille and that of La Rochelle.
Volunteers install DDoSia and receive dCoins, convertible into TON, the crypto of the Telegram ecosystem.
500,000 requests per day earn 50 dCoins, or a little over a dollar.
Europol dismantled part of the infrastructure in July 2025. A year later, the group claims around 300 operations per month.
French ports in the sights of NoName057(16)
No press release on the M-CERT website or on its social networks. The alert was sent by email on Wednesday to ports, shipowners and service providers in the sector. It was a screenshot of this message, signed by M-CERT and published on X by a cyber monitoring account, which brought out the information. The email also writes “NoName557(16)”, a typo that we correct here. The text is short. The tone is sober, but the message is clear.
“We thus discovered that the French maritime and port sector was currently being targeted by the hacktivist group supporting Russia NoName057(16). (DDOS) attacks are in progress or likely to be launched imminently.”
Alert email from M-CERT, October 14, 2026, relayed on
The center recommends that affected businesses contact the maritime gendarmerie. For its part, the group did not wait to make its claim. On his Telegram channel, included in the same At this stage, however, none of these players have confirmed any disruption.
DDoSia, the mobile game where we attack ministries
Registration takes three steps. First, you contact a Telegram bot. Then you receive a key and a server address. Finally, you launch the program. DDoSia exists on Windows, Linux, macOS and Android, and it can even be installed on a router. From there, your device waters the targets chosen by administrators. You have no say in the list. This is the principle of a denial of service attack, or DDoS: saturate a site with requests until it no longer responds.
Payroll keeps pace. According to the investigation by Vot Tak and experts from RKS.Global, relayed by The Moscow Times, 500,000 successful requests during the day are worth 50 dCoins. Each dCoin is then exchanged for 2 rubles, or approximately 2.4 cents. Everything is converted into TON before ending up in cash. So count one dollar and twenty cents for a day of service. Connecting several devices or sponsoring a friend, however, increases the meter.
For the rest, everything is done so that we come back to it. Participants rise in rank, from simple soldier to “General Dosi”, at the top of a hierarchy modeled on the army. The group itself calls it a “patriotic online game”. Europol, less enthusiastic, sees it more as “playful manipulation”. It often targets young delinquents in search of a “feeling of status”, badges and rankings to back it up.
Europol cut the servers but not the motivation
Operation Eastwood, carried out from July 14 to 17, 2025, mobilized twelve countries. The results: more than 100 servers cut, 24 searches, two arrests in France and Spain, seven arrest warrants. Five Russians have also joined the European Union's most wanted list. Among them, Mikhail Burlakov and Maxim Lupin. The agency presents them as the coordinators of the group and as leaders of a Russian public body. Both men deny it. Europol then estimates the pool at more than 4,000 sympathizers. More than a thousand of them have also received a warning about their criminal responsibility.
NoName057(16) attacks harder from Eastwood
Result? The group attacks more. Before Eastwood, Vot Tak recorded around 6,300 attack orders per month. Afterwards, 7,700. Between the end of October 2025 and mid-March 2026, NoName057(16) thus claimed 1,530 operations. Government sites represent almost a third of targets, ahead of finance and transport. Germany served as a punching bag in retaliation. Denmark was then targeted during its November municipal elections. France was entitled to its wave on December 22, with La Poste, La Banque Postale and several regional airports slowed down.
However, the actual effectiveness remains modest. An expert cited by the investigation, Leonid Yuldashev, estimates that 80% of the targeted sites have anti-DDoS protection. The Polish Digital Ministry also speaks of limited damage. But the model holds up precisely because it costs almost nothing: one dollar per day per volunteer, paid in a crypto that circulates without a bank.
