Bobik

Profile source: Mallory

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Jul 29

Observed infrastructure

Last seven days

First activity: Jul 29, 2026
Last activity: Jul 29, 2026
Feed role: C2
Host form: 1 IP / 0 hostnames

Leading locations

Leading providers

ALINDA LLC1

Infrastructure traits

Hosting 1

Reported operators

Threat actors

1 named in public reporting

NoName057(16)

NoName057(16) – The Pro-Russian Hacktivist Group Targeting NATO Bobik Dosia NoName057(16)

MITRE ATT&CK

Bobik in ATT&CK

3 distinct techniques

Techniques

3 techniques

T1498 Network Denial of Service T1105 Ingress Tool Transfer T1498.001 Direct Network Flood

Reporting

Research mentioning Bobik

Jul 22

Malpedia

NoName057(16) (Threat Actor)

NoName057(16) has been identified as a pro-Russian hacktivist group conducting distributed denial-of-service (DDoS) attacks against websites tied to governments, news agencies, military organizations, suppliers, telecommunications providers, transportation authorities, and financial institutions. The group’s operations have focused on Ukraine and countries supporting Ukraine, with reported targeting that includes Estonia, Lithuania, Norway, and Poland. Reporting links the group to the Dosia/DDoSia malware family and describes an operation that has evolved through publicly documented infrastructure, targeting patterns, and campaign activity. The activity reflects a sustained disruptive effort aimed at public- and private-sector online services in European states aligned with Ukraine, reinforcing the group’s role as a persistent politically motivated DDoS threat.