Dosia
Aliases: DDOSIA
- First seen
- 2023-06-01 00:00:00
- Malware type
- ddos, botnet
- Family
- Malware family
- Last IoC activity
- 2026-07-18 16:10:47
- Profile updated
- 2026-07-07 13:04:40
Context
Infrastructure and programs used for, as its name suggests, DDoSing. It used to be written in Python, nowadays it's written in Go. Clients: - Are written in Go. (Used to be written in Python.) - Do not seem to differ significantly across OS deployments. (Confirmed on Windows, MacOS, Linux, Android) - Seem to be partly run by NoName themselves. - Partly also run voluntarily, recruited via dedicated Telegram channels. Participants are rewarded with cryptocurrency. Prints a suggestion to use a VPN for Russia-based launches. (This yields IP-based blocking as rather ineffective, consider behavioral analysis instead.) Configuration: - Rotates near-daily. Can be browsed on https://witha.name/ (also reachable via http://withanamemwesdvodfhthjq25a5a3uas24cpgoa7qm6gchcerzpis6qd.onion/). - Is sent encrypted between C2 and Client. - Specifies target hostname, subpath, vector protocols, methods, ports, whether SSL is used, headers for HTTP, request bodies. - Any given config property can be randomly generated with per-use constraints. - Is provided by a multi-level hierarchy of C2 servers.
Reports & references
- sentinelone.com — Noname05716 The Pro Russian Hacktivist Group Targeting Nato (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Dosia (report)
- medium.com — Data Insights From Russian Cyber Militants Noname057 9F4Db98F60E (report)
- team-cymru.com — A Blog With Noname (report)
- noname.be42late.co (report)
- blog.sekoia.io — Following Noname05716 Ddosia Projects Targets (report)
- blog.sekoia.io — Noname05716 Ddosia Project 2024 Updates And Behavioural Shifts (report)
- viuleeenz.github.io — Extracting Ddosia Targets From Process Memory (report)
- medium.com — Data Insights From Russian Cyber Militants Noname057 C9B7431F8352 (report)
- go.recordedfuture.com — Cta 2025 0722 (report)
- decoded.avast.io — Ddosia Project How Noname05716 Is Trying To Improve The Efficiency Of Ddos Attacks (report)