When Pro-Russian cybercrime disguises itself as a lucrative video game

Cyberattacks against European institutions, which have been on the rise recently, are taking an unprecedented turn, to say the least. In order to destabilize the continent, the pro-Russian hacker group NoName057(16) has devised a particularly formidable strategy: turning hacking into a paid online game.

The mechanism behind the strategy? “Playing” to paralyze. The concept relies on a program called DDoSia, which users can freely install on their computers.

The goal of the operation? To flood the servers of ministries, banks, and European public institutions with requests, rendering them inaccessible. In jargon, this is what’s known as “denial-of-service attacks, or DDoS.” In exchange, participants accumulate “decoins” (an internal virtual currency), which can then be converted into the cryptocurrency TON, and subsequently into euros.

And to draw in the crowds, it must be said that the hackers’ communication strategy is extremely well-oiled. On Telegram, the operation is presented not only as an entertaining hacking game but also as an act of patriotic support for Russia.

Massive, decentralized attacks

According to joint investigations by the independent media outlet Vot Tak and the research organization RKS (reported by The Insider), NoName057(16)’s activity is massive: the pro-Russian group has reportedly been launching between 6,300 and 7,700 attack commands per month since 2023. About 300 of these succeed in crippling websites for several hours, as was the case in Denmark in November 2025.

The strength of this network lies in its decentralization: attacks are organized from numerous volunteer devices around the world. In July 2025, a large-scale international police operation (led by Switzerland, the United States, and the European Union) resulted in the seizure of more than 100 servers and the arrest of several suspects. However, the attacks resumed with renewed vigor just a few days later.

The masterminds

Europol has identified two key figures based in Moscow: Maxim Lupin (36), the director of TsISM (an official Russian center for monitoring youth networks), who moves in circles of power, and Mikhail Burlakov (39). The latter is described as the project’s lead developer.

This proximity to the Kremlin proves that NoName057(16) is far from being a group of amateurs. It's a highly organized cyberoffensive structure and, moreover, one sponsored by the state.

Passive recruitment: The trap

Cybersecurity experts warn about the participants' profile. Attracted by the app’s playful nature and the lure of financial gain, many users install DDoSia without even realizing that they are technically and legally complicit in cybercrime. In the European Union, this participation—though passive—exposes users to severe criminal penalties.

The current challenge goes beyond simple technical defense. It is now a matter of raising public awareness and shedding light on these entirely new recruitment methods, where the line between gamer and cybercriminal is blurring.