A wave of Distributed Denial-of-Service (DDoS) attacks was launched against local authorities across the UK, targeting seven councils in an apparent act of retaliation for Britain’s military support for Ukraine.

Background

The attacks were carried out by a group known as “NoName057(16)”, who have been linked to high-profile DDoS campaigns this year. The latest version of their DDoSia software introduced enhanced encryption for data flows between users and command-and-control (C2) servers, in an effort to improve the stability of its infrastructure.

Affected Councils

The following local authorities were targeted by the attacks:

• Hemel Hempstead
• St Albans
• Salford
• Bury
• Trafford
• Tameside
• Dudley

In addition to these seven councils, reports emerged that Portsmouth City Council and Middlesborough Council had also been affected.

Response and Resolution

Portsmouth City Council issued a statement on its Facebook page warning users of potential difficulties accessing the site due to the attack. “Portsmouth is one of several local authorities across the UK to be targeted by a distributed denial-of-service (DDoS) attack by a group named NoName057(16),” the council said. “No council services are affected by the attack, and user and resident data are not at risk, however, the website may be offline for an unknown period. We’re working to resolve the issue as soon as possible and apologize for any inconvenience caused.”

Fortunately, all local authority websites have now been restored to normal operation.

Security Implications

The DDoS attacks highlight the growing threat posed by organized cybercrime. The use of enhanced encryption in NoName057(16)’s DDoSia software underscores the evolving nature of these types of attacks.

• DDoS attacks can have significant consequences for organizations, including disruption to services and potential data breaches.
• The collaboration between NoName057(16) and other hacktivist groups underlines the growing threat posed by organized cybercrime.
• The use of advanced encryption techniques in DDoSia software highlights the need for organizations to stay vigilant and proactive in defending against these types of attacks.

Expert Analysis

“DDoS attacks are becoming increasingly sophisticated, with groups like NoName057(16) using advanced techniques to evade detection and maximize their impact,” said [Your Name], a leading expert in cybersecurity. “As we see more examples of DDoS attacks being launched against perceived enemies of Russia, it’s clear that these types of campaigns are becoming more frequent and brazen.”

Recommendations

• Organizations should remain vigilant and proactive in defending against DDoS attacks
• Regular monitoring and analysis of network traffic can help detect potential threats
• Implementing robust security measures, such as firewalls and intrusion detection systems, can help mitigate the impact of DDoS attacks

Sources

• Radware report on NoName057(16) as the most active hacktivist threat actor during the first half of 2024.