Sekoia TDR analysts documented in a report published on Sekoia TDR a comprehensive technical and victimology analysis of DDoSia — the Go-written DDoS toolkit developed by pro-Russian hacktivist group NoName057(16). As of June 2023, the main NoName057(16) Telegram channel had exceeded 45,000 subscribers while the DDoSia project channels had over 10,000 users. Volunteers receive cryptocurrency compensation (TON wallet-based) for contributing bandwidth to DDoS attacks against Ukraine-supporting countries.
Registration Flow: DDosiabot, client_id.txt Bcrypt Hash, and Encrypted Target Distribution
Participation begins via Telegram bot @DDosiabot, which requires a TON wallet and distributes two files: client_id.txt (a Bcrypt-hashed user identifier starting with $2a$16$) and help.txt (setup instructions). The client binary (April 19, 2023 version: six executables across Linux AMD64/ARM, macOS AMD64/ARM64, Windows AMD64/ARM64) authenticates to the C2 via POST to /client/login with a User-Hash (client_id.txt content) and Client-Hash (SHA256 of machine UID + PID), receiving a numeric token. It then sends GET to /client/get_targets with the token in a Time header, receiving a JSON response with a base64-encoded AES-GCM encrypted data field (~70,000 characters) containing the target list.
AES-GCM Decryption: Token Division, User-Hash Key Derivation
Sekoia's reverse engineering of d_windows_amd64.exe (Go binary with decompilation-resistant structure) confirmed AES-GCM encryption. Dynamic analysis revealed the full key derivation: the token is divided by 5 (integer division), added to the User-Hash string, and the last 32 characters of the result are hex-converted to form the 32-byte key. The IV is the first 12 bytes of the base64-decoded ciphertext; the GCM tag is the last 16 bytes; the ciphertext is the remainder. Decrypted JSON yields two fields: targets (IPv4, URL, HTTP method, optional POST body with $_1/$-1 variable placeholders) and randoms (a table of random strings substituted for those placeholders to bypass target-side caching mechanisms).
Victimology (May–June 2023): NATO Eastern Flank Primary, 486 Domains, Wagner Group Anomaly
Automated target monitoring across May 8–June 26, 2023 identified 486 unique targeted domains. Ukraine topped the list, followed by NATO Eastern Flank members (Lithuania, Poland, Czech Republic, Latvia) and secondarily Western Europe (France, UK, Italy, Canada). Ukrainian education platforms zno.testportal.com[.]ua and e-journal.iea.gov[.]ua were the top two targets — Sekoia assesses strategic timing to coincide with the May–June exam period for maximum media impact. On June 24, 2023 — coinciding with the Wagner Group's attempted offensive in Russia — the only targets throughout the entire day were wagnercentr[.]ru and wagner2022[.]ru, a unique single-victim day never previously observed and conducted without any Telegram announcement, marking the sole instance of NoName057(16) attacking Russian-affiliated entities. On June 21, hours after President Macron announced SAMP/T air defense delivery to Ukraine, multiple French transport group RATP domains were immediately targeted — demonstrating the group's near-real-time geopolitical response cycle.