Cyber Incident Victim: Swiss Federal Government

On January 21, 2025, multiple Swiss websites experienced widespread disruptions due to distributed denial-of-service (DDoS) attacks attributed to the pro-Russian hacker group NoName057(16). The attacks primarily targeted financial institutions and municipal government portals, with Zürcher Kantonalbank and Waadtländer Kantonalbank confirming service outages affecting their public-facing websites. Several municipalities—including Luzern, Adligenswil, Kriens, and Ebikon—also reported inaccessible digital services during the incident. NoName057(16) publicly claimed responsibility through a post on the social media platform X, explicitly stating their intent to "test the resilience of Swiss internet infrastructure" while listing the affected entities. The group characterized the attacks as retaliation against Switzerland's political alignment with Ukraine amid the ongoing conflict with Russia, consistent with their established pattern of targeting nations perceived as hostile to Russian interests. Technical analysis confirmed the attacks employed standard DDoS methodology, overwhelming servers with artificially inflated traffic volumes to render services unavailable to legitimate users. No data breaches or system infiltrations occurred, as DDoS attacks exclusively disrupt availability rather than compromise confidentiality. Service restoration timelines varied across entities, though most reported full recovery within hours of mitigation efforts. The incident marked Switzerland's latest encounter with this threat actor, following similar disruptions to banking and government infrastructure throughout 2024.

NoName057(16) has conducted cyber operations since 2022, specializing in politically motivated DDoS campaigns against European nations supporting Ukraine. Their operational model relies on a decentralized network of anonymous participants coordinating attacks through platforms like Telegram and X. The group explicitly designates targets based on geopolitical criteria, prioritizing countries like Germany, Poland, Baltic states, and Switzerland that provide military or economic aid to Ukraine. Historical targeting patterns show consistent focus on disrupting public-facing websites of financial institutions, municipal governments, and critical infrastructure operators. While the January 21 attacks exclusively impacted website availability, the group has previously expanded operations to include defacement and propaganda dissemination during incidents in other nations. Swiss authorities have not disclosed specific defensive measures implemented during this incident, though standard DDoS mitigation protocols typically involve traffic filtering, rate limiting, and collaboration with internet service providers. The persistent nature of these attacks reflects NoName057(16)'s continued capacity to mobilize resources against Swiss digital infrastructure despite increased cybersecurity awareness following prior incidents. Financial institutions reiterated their contingency plans for service continuity during such disruptions, though customer access remained intermittently affected during peak attack periods.