The pro-Russian hacking collective NoName057(16) has issued a fresh wave of claims against European companies, naming Free, La Poste Mobile and Danfoss. According to the group’s statements, the campaign spans at least twenty countries, primarily NATO members, and encompasses water networks, electrical installations, factories and food-processing facilities.
ZATAZ analysis indicates that the published credentials originate from aggregated leaks and phishing collections rather than direct breaches of the targeted organizations. For Free, the collective claims multiple DDoS disruptions, access to customer portals and a database of 636,932 users. For La Poste Mobile, it alleges server downtime via DDoS and the release of employee and customer login samples. For Danfoss, the group asserts a DDoS attack on its website together with interference in refrigeration systems and the leak of more than 2,500 lines of data.
Recycled credentials and unproven intrusions
The exposed records are genuine stolen credentials, yet their presence in the dumps does not prove they were taken from the named companies. Many entries appear in previously known compilations, often called “combos,” assembled from multiple unrelated sources. An email address belonging to an employee therefore does not demonstrate compromise of the employer’s infrastructure.
The same distinction applies to the DDoS claims. Site unavailability at a given moment does not confirm data exfiltration or industrial-process disruption. NoName057(16) has also described remote access via VNC to a textile-filling line in Vittorio Veneto, Italy, and to a hydroelectric plant in northern Italy using Siemens SIMATIC controllers. These assertions remain unverified.
DDoSia recruitment and industrial threats
Alongside the claims, the group has resumed recruitment for its DDoSia platform, offering tools, guidance and anonymity to new participants. The messaging references the earlier Eastwood law-enforcement operation and frames participation as both ideologically motivated and financially rewarded.
Security researchers continue to stress that credential validity must be checked individually and that multi-factor authentication should be enforced on all sensitive accounts. Organizations named in the posts are advised to monitor for anomalous traffic and to treat the published data as a reminder of the persistent risk posed by password reuse.
