Kevin Beaumont

NoName057(16) are targeting the UK today, so I shall start monitoring them and naming their targets and attack types.

Their targeting: https://raw.githubusercontent.com/GossiTheDog/Monitoring/main/NoName/targets_2023_12_07_11am.txt

Currently:
pa.eastcambs.gov.uk
politics.leics.gov.uk
www.liverpool.gov.uk
www.mil.be
www.bollington-tc.gov.uk
www.cranbrooktowncouncil.gov.uk
cert.be
my.swiftcard.org.uk
www.monarchie.be
www.premier.be
www.david-clarinval.be
www.dekamer.be
www.senaat.be

#threatintel #noname

Dec 7, 2023 at 11:23amWeb
Show threadKevin BeaumontDec 7, 2023
Note this list includes targets they haven't announced yet on Telegram.
Show threadKevin BeaumontDec 7, 2023
Keep up, NoName. Edit: to be clear I mean catch up as I already named these.
Show threadKevin BeaumontDec 7, 2023

quick question - would publishing the NoName DDoS targets in a format like this each day be valuable?

I just had a quick workflow play, I think I can do it.

#threatintel

Show threadKevin BeaumontDec 7, 2023
This is how NoName[16] are DDoSing West Yorkshire Metro.. apparently it's enough to cause Azure App Gateway to fall over.
Show threadKevin BeaumontDec 7, 2023
I wrote this up: https://doublepulsar.com/tracking-russias-noname057-16-attempts-to-ddos-uk-public-services-057e8ab54fe4
Show threadKevin BeaumontDec 8, 2023

Later today #NoName will announce they are attacking:

cts21.czechtrade.cz
www.mzv.cz
klient.czechtrade.cz
www.czechtrade.cz
exporters.czechtrade.cz
www.dpp.cz
www.pse.cz
www.moneta.cz
api.moneta.cz
www.rzp.cz
www.senat.cz
pspen.psp.cz
www.vlada.cz
www.mvcr.cz
www.financnisprava.cz
www.policie.cz
www.prg.aero
gate.prg.aero
newfids.prg.aero
ftp.prg.aero
fids.prg.aero
idc-portal-tas.prg.aero

Target list: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2023_12_08_10am.txt

#precrime #threatintel

Monitoring/NoName/targets_2023_12_08_10am.txt at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadKevin BeaumontDec 8, 2023
There we go. #NoName #precrime #threatintel
Show threadKevin BeaumontDec 8, 2023
Noname have named other targets already in the list. #NoName #precrime #threatintel
Show threadKevin BeaumontDec 11, 2023

Today's #NoName DDoS targets #threatintel

www.mtc.government.bg
www.port-varna.bg
port-burgas.bg
www.parliament.bg
customs.bg
bulbankonline.bg
dskbank.bg
www.dskdirect.bg
www.bnb.bg
www.procreditbank.bg
probanking.procreditbank.bg
www.ccbank.bg
www.fibank.bg
my.fibank.bg
testiam-idsext.customs.bg
ids.customs.bg
www.government.bg
www.president.bg

Target list: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2023_12_11_11am.txt

Monitoring/NoName/targets_2023_12_11_11am.txt at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadKevin BeaumontDec 11, 2023

#NoName DDoS targets, UK and Norway. Includes a failed attempt at Rishi Sunak's website. #threatintel

www.horiba-mira.com
www.rotork.com
www.lcia.org
southendairport.com
www.stortinget.no
ruter.no
www.autopass.no
www.boreal.no
www.sj.no
bpsnord.no
ferde.no
www.nor-way.no
dskbank.bg
www.bnb.bg
probanking.procreditbank.bg
my.fibank.bg
testiam-idsext.customs.bg
www.government.bg
www.president.bg
www.rishisunak.com

Target list: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2023_12_11_3pm.txt

Monitoring/NoName/targets_2023_12_11_3pm.txt at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadKevin BeaumontDec 11, 2023
Here's the full targeting for Rishi's site:
Show threadKevin BeaumontDec 13, 2023

Here's the #NoName targets today. #threatintel

www.energy-community.org
www.zaporizhstal.com
uges.com.ua
portal.bank.gov.ua
cvp.tax.gov.ua
ssu.gov.ua
bank.gov.ua
kyiv.tax.gov.ua
www.umcc-titanium.com
smtp.energy-community.org
velta-ua.com
www.ztoe.com.ua
ztmc.zp.ua
mcs.energy-community.org
academy.ssu.gov.ua
mgate.energy-community.org
www.ztr.ua
uhe.gov.ua
smtp2.energy-community.org
tax.gov.ua
stockmarket.gov.ua
wvp.tax.gov.ua
www.mev.gov.ua

Target list: https://github.com/GossiTheDog/Monitoring/tree/main/NoName

Monitoring/NoName at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadKevin BeaumontDec 14, 2023

#NoName targets this afternoon. #threatintel

www.europarl.europa.eu
www.mil.be
cert.be
www.monarchie.be
www.premier.be
www.david-clarinval.be
www.dekamer.be
www.senaat.be
www.ecb.europa.eu
www.consilium.europa.eu
curia.europa.eu
www.eesc.europa.eu
www.europol.europa.eu
www.ebrd.com
mobilite-mobiliteit.brussels
idp.belgiantrain.be
www.belgiantrain.be
www.bruxelles.be
www.stib-mivb.be

Target list: https://github.com/GossiTheDog/Monitoring/tree/main/NoName

Monitoring/NoName at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadKevin BeaumontDec 15, 2023

#NoName targets this afternoon are the same as yesterday, apparently they took Friday off. Target list: https://github.com/GossiTheDog/Monitoring/tree/main/NoName

They photoshopped ebrd being offline. https://www.ebrd.com/what-we-do/war-on-ukraine

#threatintel

Monitoring/NoName at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadKevin BeaumontDec 19, 2023

#NoName reran a bunch of prior targets over the past 3 days, e.g. the targeting of the same UK sites again. #threatintel

Some new targets this morning:

www.vfgh.gv.at
immobilien.oebb.at
www.ris.bka.gv.at
www.railtours.oebb.at
bcc.oebb.at
authportal.oebb.at
www.oebb.at
www.e-steiermark.com
www.bmeia.gv.at
presse.oebb.at
bahnhofcitywienwest.oebb.at
shop.oebb.at
serviceline.oebb.at
presse-oebb.at
tsprodsam.oebb.at
apa.at
www.kelag.at

Target list: https://github.com/GossiTheDog/Monitoring/tree/main/NoName

Monitoring/NoName at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadKevin BeaumontDec 20, 2023

#NoName plan to announce Sweden as DDoS targets later today.

Targets:

www.sundsvallshamn.se
www.norrtag.se
www.vasttrafik.se
login.vasttrafik.se
www.polisen.se
www.msb.se
login.msb.se
www.transportstyrelsen.se
www.digg.se
www.sjofartsverket.se
international.stockholm.se
goteborg.se
malmo.se
www.uppsala.se
www.linkoping.se
www.orebro.se
www.vasteras.se
www.eskilstuna.se
www.vgregion.se

Target list and config: https://github.com/GossiTheDog/Monitoring/tree/main/NoName

I have all of NoName's targeting in Excel if data needed.

Monitoring/NoName at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadKevin BeaumontDec 20, 2023
The screenshots are obviously the condensed version, they do webapp floods primarily, e.g.
Show threadKevin BeaumontDec 20, 2023
There we go. #NoName #threatintel
Show threadKevin BeaumontDec 21, 2023

#NoName DDoS will be going to Italy today.

Their target list:
www.giorgiameloni.it
www.porto.trieste.it
port.taranto.it
www.sinfomar.it
amat.cloud.eleagol.it
www.sienamobilita.it
www.gtt.to.it
www.ctmcagliari.it
actv.avmspa.it
telematicoprova.adm.gov.it
richiestamodifiche.adm.gov.it
iampe.adm.gov.it
telematico.adm.gov.it
www.consob.it
www.assosim.it
www.agcm.it

Target list and config: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2023_12_21_10am.txt

#threatintel

Monitoring/NoName/targets_2023_12_21_10am.txt at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadKevin BeaumontDec 22, 2023

#NoName DDoS Finland today, as usual they failed to DDoS most of their targets properly.

www.hsl.fi
portofhanko.fi
www.kyberturvallisuuskeskus.fi
www.expressbus.fi
www.ssvoy.fi
virtuaali.vayla.fi
sso.vayla.fi
extranet.vayla.fi
www.traficom.fi
extidpevaluointi.traficom.fi
extidptesti.traficom.fi
ikkuna.traficom.fi
eservices.traficom.fi
paarautatieasema.fi
www.ely-keskus.fi
www.op.fi
www.suomenpankki.fi
www.vero.fi
www.a-katsastus.fi

Target list and config: https://github.com/GossiTheDog/Monitoring/blob/main/NoName/targets_2023_12_22_11am.txt #threatintel

Monitoring/NoName/targets_2023_12_22_11am.txt at main · GossiTheDog/Monitoring

Contribute to GossiTheDog/Monitoring development by creating an account on GitHub.

GitHub
Show threadSkyglobeDec 21, 2023
@GossiTheDog amat.cloud.eleagol.it Login.aspx in HTTP 
Show threadMoritz DietzDec 21, 2023
@GossiTheDog Is this the ERAS tour or what
Show thread Why Not Zoidberg? 🦑Dec 20, 2023
@GossiTheDog Lovely. Let's see how much of a mess this causes.
Especially interesting to see how MSB handles it, it's their job.
Show thread Why Not Zoidberg? 🦑Dec 20, 2023

@GossiTheDog Huh, doesn't seem to be a major operation. No delays on most sites, MSB login down for a couple of minutes.

I assume they will loop around...

Show threadjonathanDec 20, 2023
@GossiTheDog Lol wat
Show threadBen Montour Dec 14, 2023
@GossiTheDog Any chance of adding the missing trailing } to these to make valid JSON out of the box? Or is it removed for a purpose?
Either way, thank you for these!
Wish I could see the secret sauce of how you pull this stuff, but understand keeping that close to the chest so to speak.
Show threadAlun JonesDec 11, 2023
@GossiTheDog That's "London Southend Airport" :)
Show threadkorvroffeDec 11, 2023
@GossiTheDog Sweden just announced another 140 mil EUR package to Ukraine, will probably be targeted in the next few days one would guess? Might be worth keeping an eye for it ahead.
Show threadCaliDec 8, 2023
@GossiTheDog nice one
Show threadStanislav OchotnickýDec 8, 2023
@GossiTheDog I suspect nobody in #Czech government agencies is paying attention to your posts. Wonder if anyone in my circles can forward to someone...
Show thread0x446172696FDec 8, 2023
@drizzy @GossiTheDog
It doesn't really matter, once a website is on the targetlist it is already being attacked.
It might buy them a couple of minutes but in practice that won't do much.
NN only mentions successful attacks on their Telegram.
Not to burst any bubble but Kevin isn't predicting anything, he extracts the active targetlist from their DDoS client and publishes it in full, whereas NN only publishes sites that went down.
Show threadJasonBaconDec 7, 2023
@GossiTheDog Nice! Having that data would be helpful. They have been targeting Italian gov and agencies in the last months too
Show threadthe vessel of morgannaDec 7, 2023
@GossiTheDog Looks more like the backend fell over, I've seen similar errors from app gateway when the on-prem relay ate shit.
Show threadSimon RolfmoreDec 7, 2023
@GossiTheDog that’s dangerously close to starting haveibeenddosed.com
Show threadgmmdsDec 7, 2023
@GossiTheDog Great! Really interesting!
Show threaddercraigDec 8, 2023
@GossiTheDog that would be very helpful. We've been targeted several times without any effect (https://media.ccc.de/v/camp2023-57023-how_to_survive_getting_ddosed_by_anonymous_cyberberkut_killnet_and_noname057_16_since_2012), but it's always nice to be able to easily check who's attacking. ;)
How to survive getting DDoSed by Anonymous, Cyberberkut, Killnet and noname057(16) since 2012

media.ccc.de
Show threadpetur 😶🇺🇦🇵🇸🇹🇼Dec 7, 2023
@GossiTheDog wait, are these targets that have been breached already?
Show threadpetur 😶🇺🇦🇵🇸🇹🇼Dec 7, 2023
@GossiTheDog and also Belgium government, king (palace) and federal cybercrime team
Show threadLeeDec 7, 2023
@GossiTheDog Watching this very closely thank you
Show threadZipkidDec 7, 2023
@GossiTheDog may be interesting. We’ve been hit by fallout frome those attacks I believe.