The U.K. National Cyber Security Centre (NCSC) issued fresh guidance calling on local government and critical infrastructure operators to harden denial-of-service (DoS) defences following a rise in pro-Russia hacktivist activity targeting organisations. The hackers attempt to disrupt operations, take websites offline, and disable services.
“In particular, the group NoName057(16) has been active since March 2022, and have been conducting attacks against government and private sector entities in NATO member states and other European countries that are perceived as hostile to Russian geopolitical interests,” the NCSC said in its Monday guidance. “These attacks have included frequent DDoS attempts against UK local government. “
Furthermore, the group operates primarily through Telegram channels and uses GitHub (and other websites and repositories) to host the proprietary tool DDoSia and share tactics, techniques, and procedures (TTPs) with followers.
This is not the first time that the NCSC has called out activity from Russian-aligned groups targeting UK organisations. In December 2025, the NCSC co-sealed an advisory highlighting that pro-Russian hacktivists groups have been conducting worldwide cyber operations against numerous organisations and critical infrastructure sectors.
Before that, in 2023, the NCSC published an alert on the risk posed by state-aligned adversaries following the Russian invasion of Ukraine. These attacks are ideologically (rather than financially) motivated, and reflect an evolution in the threat that now targets U.K. operational technologies. Due to these underlying threats, the agency calls upon OT owners to follow recommended mitigation advice to harden their cyber defences.
What is the NCSC recommending?
The NCSC is advising organisations to review their cyber defences and strengthen resilience against attacks from Russian-aligned groups. A particular focus is being placed on denial-of-service protections, beginning with a clear understanding of service architecture. Across most digital services, there are multiple points where attackers can attempt to overload or exhaust resources, disrupting access for legitimate users. These vulnerabilities must be identified, with responsibility clearly assigned to either the organisation itself or an external supplier in each case.
Upstream defences should start with ensuring service providers are prepared to absorb and mitigate resource exhaustion where they are best positioned to do so. This includes understanding what denial-of-service protections an ISP applies at the account level, evaluating the use of third-party DDoS mitigation services for traffic-based attacks, and considering content delivery networks for web-facing services. It also requires clarity on when and how providers may throttle or limit network access to protect other customers, and whether critical functions should be distributed across multiple service providers to reduce concentration risk.
The agency detailed that services must also be designed to scale rapidly when attacks cannot be fully handled upstream or are only blocked after detection. This means enabling elastic scaling across applications and infrastructure. Cloud-native environments can automate this through provider APIs, while private data centres rely on modern virtualisation and sufficient spare hardware capacity to absorb sudden load.
Equally important is defining a response plan that allows services to continue operating, even in a degraded state, during an attack. Effective plans account for graceful degradation, shifting attacker tactics, the ability to retain administrative access under pressure, and scalable fallback arrangements for essential services.
Finally, resilience depends on testing and visibility. Defences must be exercised to establish the types and volumes of attacks they can withstand, while continuous monitoring is essential for detecting attacks as they begin and analysing performance while they unfold.
Last November, the ENISA (European Union Agency for Cybersecurity) reported that public administrations across the EU are facing a surge in cyberattacks, with hacktivists increasingly relying on distributed denial-of-service (DDoS) campaigns. Central governments were the most targeted, accounting for 69% of incidents. The majority of incidents targeted the websites of parliaments, ministries, and national authorities/agencies, with a significant proportion being caused by DDoS attacks.
