Cyber Incident Victim: French National Institute of Labour, Employment and Vocational Training
Date:
May 2023
Location:
France
Summary
A pro-Russia hacktivist group known as NoName conducted a DDoS attack against the French National Institute of Labour, Employment and Vocational Training, causing its website to become inaccessible. The incident was part of a broader offensive targeting multiple French entities in retaliation for the nation's support of Ukraine. The group claimed responsibility for the attack, which successfully disrupted online services for the victim organization.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around May 5, 2023, the pro-Russia hacktivist group known as NoName057(16) executed a series of distributed denial-of-service (DDoS) attacks against multiple French entities. The group publicly announced these cyber attacks on its Telegram channel, explicitly listing its targets. These targets included the French Senate, the French National Institute of Labour, Employment and Vocational Training, the National Center for Space Research of France, and the French defense company Naval Group. The group's stated motivation for these attacks was retaliation against the French government for its support of Ukraine in the ongoing conflict with Russia. This incident was part of a broader campaign of DDoS attacks against Western organizations that the NoName057(16) collective had been conducting since March 2022.
The attack against the French Senate's website was successful in causing significant disruption. Access to the Senate's website was taken offline and remained unavailable for a period of time. The disruption was publicly acknowledged by the French Senate itself through its official Twitter account. In a tweet published on the day of the incident, the Senate confirmed that access to its website had been disrupted since the morning and that its technical team was fully mobilized to remedy the malfunctions. The tweet also included an apology for the inconvenience caused to users attempting to access their online services.
While the article explicitly confirms the French Senate website was taken offline, the specific impact on the other named targets, including the French National Institute of Labour, Employment and Vocational Training, is not detailed in the provided source material. The article only states that the NoName group announced the attacks against these institutions. Therefore, the exact nature and duration of any disruption experienced by the Institute's systems cannot be confirmed from this single source. The announcement by the threat actor indicates an intent to disrupt, but independent confirmation of successful impact on each specific entity is not provided.
The public response from the French Senate represents the primary confirmed response action taken by a victim organization. The response was focused on incident remediation and public communication. The technical team worked to restore service to the website, and they publicly acknowledged the outage to manage user expectations. There is no information provided regarding any deeper forensic investigation, attempts to attribute the attack beyond the group's own claim, or any law enforcement action taken in response to this specific incident.
The consequences of the attack were primarily operational and reputational. The French Senate, a key national institution, suffered a public disruption to its digital services, preventing citizens from accessing its website. This achieved the hacktivist group's apparent goal of causing inconvenience and drawing attention to their political message opposing French foreign policy. The incident served as a demonstration of the group's continued capability and willingness to target high-profile Western entities in support of the Russian geopolitical position. The activity of the NoName057(16) group has been tracked by cybersecurity experts, highlighting its status as one of the most active pro-Russia collectives conducting these types of attacks since the escalation of the conflict in Ukraine.