Cyber Incident Victim: French National Assembly
Date:
Mar 2023
Location:
France
Summary
A pro-Russian hacker group known as NoName057(16) executed a distributed denial-of-service (DDoS) attack against the French National Assembly's website, causing it to be brought down for an extended period. The group claimed the attack was motivated by France's support for Ukraine and domestic political turmoil surrounding unpopular pension reforms. While the Assembly officials were working on identification and could not immediately confirm the attackers' origin, the group has a history of similar pro-Kremlin operations across Europe. The hackers also claimed to have targeted the Senate's website, though that site remained available.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 27, 2023, the official website of France's National Assembly was brought down by a cyberattack. The pro-Kremlin hacker group known as NoName057(16) publicly claimed responsibility for the attack on its Telegram channel. The group stated its motivation was a combination of French domestic politics and foreign policy, citing President Emmanuel Macron's support for Ukraine and his government's highly unpopular pension reform. They specifically referenced Macron's use of a constitutional tool to pass the pension legislation without a parliamentary vote and the National Assembly's recent rejection of a vote of no confidence in the government, which they described as a catalyst for mass protests. The group employed a distributed denial-of-service (DDoS) attack, a technique designed to overwhelm a website with traffic and render it inaccessible to legitimate users.
The impact of the attack was significant, as the National Assembly's website remained under maintenance and inaccessible throughout the afternoon of March 27th. The hacker group boasted about this sustained disruption on Telegram, noting the site "can't recover all day after our attack." NoName057(16) also claimed to have targeted the website of the French Senate, but that site remained available and operational during the same period. In its public statements, the group framed the attack as part of a broader campaign, referencing their previous attacks against other nations that supported Ukraine, including Poland, Denmark, the Czech Republic, and Lithuania. While the group claimed Russian affiliation, National Assembly officials told franceinfo that they could not yet officially confirm the attack originated from Russian hackers at that time and were working on identification. This incident followed a known pattern of Russian-aligned groups supporting and attempting to amplify anti-establishment protests within France.