CSIDB logo
Incident

Wotan Forest

Incident posture

Attack window
Aug 2016
Location
Czechia
Status
Historical
CIA posture
Available to members
Updated
2026-03-04 17:38

Linked entities

Victim
Wotan Forest
Threat actors
2 actors
Sources
2 sources

Timeline

Occurred
Aug 2016
Discovered
Pending
Disclosed
Pending
Resolved
Pending

Summary

Anonymous hackers launched DDoS attacks against companies owned by Czech Finance Minister Andrej Babis, including Wotan Forest, under the #OpBlokada campaign. The collective opposed new online gambling legislation granting authorities power to block unlicensed gambling sites, alleging it established a framework for broader internet censorship. The short-lived operational attacks targeted Agrofert, Hyza, Cepro, Preol, Penam, and Uniles, with warnings of future disruptions. While the government framed the law as combating tax evasion, the hackers contended it enabled unchecked ministerial authority to restrict online content.

Motives

Detailed motive labels are available to members.

2 motives

TTPs

Detailed technique labels are available to members.

1 technique

Description

On August 1, 2016, the Czech and Slovakian divisions of the Anonymous hacker collective launched distributed denial-of-service (DDoS) attacks against multiple private companies owned by Czech Finance Minister Andrej Babiš. The group designated this operation #OpBlokada, framing it as a hacktivist response to controversial online gambling legislation spearheaded by Babiš and approved by the Czech government. The new law granted authorities the power to block access to unlicensed gambling websites nationwide, with the stated objective of combating tax evasion within the gambling industry. Anonymous contested this justification in a YouTube statement, alleging the legislation established infrastructure for broader internet censorship. They argued the Finance Ministry, under Babiš's leadership, would gain unchecked authority to create and enforce blocklists beyond gambling domains, characterizing the law as a dangerous precedent for state-controlled internet filtering.

The initial wave of DDoS attacks temporarily disrupted operations at Agrofert, Hyza, Cepro, Preol, Penam, Uniles, and Wotan Forest—companies comprising Babiš's business portfolio. These attacks were deliberately brief, intended as a symbolic demonstration of capability rather than sustained disruption. Anonymous publicly claimed responsibility and issued warnings of escalating actions in subsequent days unless the law was repealed. The group emphasized concerns that the gambling website blocklist mechanism could be repurposed to suppress other types of online content under future legislation. No technical specifics regarding attack vectors, mitigation efforts by the targeted companies, or further disruptive outcomes beyond the initial service interruptions were disclosed in available reports. The Czech government maintained its stance that the gambling law addressed legitimate fiscal concerns without elaborating on its response to the cyberattacks.

Sources

Sources available to members: 2 sources.

CSIDB