NoName057(16)’s DDoS Claim Against Greek Institutions (March 2024): Unconfirmed
On 24 March 2024 the pro-Russian group NoName057(16) claimed it had knocked the websites of nine Greek institutions offline. These were DDoS attacks, which flood a site with traffic; nothing was broken into, and no outage on that day has been confirmed.
The list included the Thessaloniki metro, port and airport, the Ministry of Infrastructure and Transport, the Hellenic Railways Organisation, the Register of Shipping Companies and the Center for European Constitutional Law.
What is confirmed
The method, at least. NoName gets volunteers to run its software and flood target websites; Eurojust says about 4,000 people downloaded it. The Alliance for Securing Democracy, which tracks pro-Kremlin operations, logged this campaign as DDoS and noted that “it is uncertain whether NoName stole any data”.
No Greek authority or outlet reported an outage at the named institutions on 24 March 2024. Whether any site actually went down rests on the group’s word.
What happened next
- July 2025: the IT director of the Thessaloniki Port Authority told Skai that DDoS attacks by groups such as NoName057 had targeted the port in 2024, among dozens of mostly automated attacks a month. He gave no dates.
- 15 July 2025: in Operation Eastwood, police and prosecutors from eight countries disrupted more than 100 of the group’s servers. Seven arrest warrants followed, six of them German, including against two suspected ringleaders.
- 9 December 2025: the US Justice Department charged a Ukrainian woman with supporting the group. The State Department offers up to $10 million for information on its members.
About NoName057(16)
NoName057(16) appeared in March 2022, soon after Russia invaded Ukraine, and attacks websites in countries that back Kyiv. US prosecutors call it “a state-sanctioned project” run in part by an IT organisation created by Russian presidential order. A DDoS attack makes a site unreachable while it lasts; it gives the attacker no access to the data behind it.
About this report
Rewritten on 12 November 2026. The original report of 24 March 2024 relied on the group’s own claim as relayed by a monitoring account. It also described the DDoS attacks as “infiltrating” the institutions and as “successful breaches”, which they were not.
Our Mission
We believe security online security matters and its our mission to make it a safer place.