The UK government issued a fresh warning on Monday about the persistent cyberattacks by Russian-aligned hacktivist groups, cautioning that local government authorities and operators of critical national infrastructure remain prime targets.
In a new alert, the National Cyber Security Centre (NCSC), part of GCHQ, said these groups are carrying out disruptive denial-of-service (DoS) attacks designed to overwhelm websites and take online services offline, thereby preventing the public from accessing essential information and support.
While such attacks are often technically simple, the NCSC warned that recovery from even short-lived outages can cause significant disruption, financial loss, and operational strain, while also undermining public trust.
“We continue to see Russian-aligned hacktivist groups targeting UK organisations and although denial-of-service attacks may be technically simple, their impact can be significant,” said Jonathon Ellison, Director of National Resilience at the NCSC.
“By overwhelming important websites and online systems, these attacks can prevent people from accessing the essential services they depend on every day.”
Local Government And Critical Services At Risk
The alert particularly highlights risks for local authorities and organisations running critical national infrastructure such as utilities and transport services. However, the NCSC warned all organisations should treat the threat seriously and take steps to improve their cyber defences. He urged them to act quickly by reviewing and implementing the agency’s freely available guidance.
Persistent Hacktivist Groups
One of the most persistent groups named in the warning is NoName057(16), a pro-Russian hacktivist collective that has been targeting UK and European organisations since March 2022. The group is known for repeatedly targeting a small number of organisations for days at a time, often forcing council websites offline.
The group operates a platform known as DDoSia, which allows supporters to contribute computing power to crowdsourced attacks in exchange for small rewards or online recognition. NoName057(16) is believed to be driven by ideology rather than financial gain, linked to perceived Western support for Ukraine.
In July 2025, an international law enforcement effort known as Operation Eastwood disrupted the group by arresting two members, issuing eight arrest warrants, and shutting down around 100 servers. Despite this, UK authorities believe the group’s main operators remain in Russia, beyond the reach of law enforcement, which allows them to continue launching attacks.
Growing Geopolitical Cyber Pressure
The NCSC noted that Russian-aligned hacktivist activity has increased since the invasion of Ukraine in 2022, with groups frequently targeting public and private organisations across NATO member states and Europe. In December 2025, the UK co-signed an international advisory warning of similar threats against government bodies and private-sector organisations across Europe.
Although hacktivist groups often exaggerate the impact of their attacks online, the NCSC said their methods can still cause real disruption, especially when organisations rely on unpatched systems or insecure remote access tools.
Advice To Organisations
To mitigate the risk of disruption, the NCSC recommends that organisations strengthen upstream protections through internet service providers, third-party DDoS mitigation services, and content delivery networks. It also advises designing systems that can scale quickly under attack, rehearsing incident response plans to reduce the impact of future attacks, and continuously testing and monitoring defences.
The latest warning comes amid broader concerns from UK security officials, particularly during a period of heightened geopolitical tension, reinforcing the message that even relatively simple cyberattacks can have serious consequences.
