Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 04-Dec-2024 01:18:20 JST Kevin Beaumont

   in reply to

   NoName UK impact for the day - 3 of the 5 council websites targeted are still down

   For some reason NoName still target liverpool.gov.uk, which has had working mitigations for well over a year. They still pretend to their supporters they DDoS that one, but never do. They don't even bother to change their attack config.

   Keighley literally redirected their site to a site with "DDoS" in the name.

   In private companies/orgs, 3 of the 8 orgs are still down. Albion 8% uptime.

   #NoName #threatintel

2. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 31-Oct-2024 03:19:28 JST Kevin Beaumont

   in reply to

   One other thing for UK councils to note, NoName store the configs and rotate them. E.g. by tomorrow morning, around 6am UK time, they'll likely change to different councils.

   But they will periodically rotate back to the same attack config whenever "Keira" (they can't spell the PMs name) does something they don't like. E.g. they've been doing the same attack at liverpool.gov.uk for over a year intermittently, despite it being mitigated nowadays. So have a process on how to deal the next time.

3. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Sunday, 21-Jan-2024 20:20:28 JST Kevin Beaumont

   in reply to

   How #NoName manipulate their audience (and probably bosses) - they post photoshopped screenshots of outages, and have links to check-host.net - which always show sites down.

   E.g. I've attached the report for liverpool.gov.uk just now, which shows as down - but it's actually available.

   The net effect is an audience of tens of thousands on Telegram cheering on nothing.

   #threatintel