Cyber Incident Victim: Guvernul României
Date:
May 2025
Location:
Romania
Summary
The pro‑Russian hacker collective NoName057, also known as DDOSIA, launched a distributed denial‑of‑service campaign against several Romanian online services, including the official portals of the Ministry of Interior, the Ministry of Justice, the presidential candidate Crin Antonescu and a range of other government‑related domains such as banumuscel.ro, ccr.ro, gov.ro, just.ro, mae.ro, nicusordan.ro, senat.ro and silviupredoiu.ro. The attacks rendered the sites temporarily inaccessible before the National Directorate for Cyber Security confirmed their restoration and noted that all listed targets were operational again. NoName057 claimed responsibility via its Telegram channel, stating that it had successfully delivered DDoS surprises to the targeted ministries.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On Sunday, 4 May 2025, during the Romanian presidential election day, a series of distributed denial‑of‑service attacks targeted multiple government and candidate websites. The affected domains included the official sites of the Ministry of Interior, the Ministry of Justice, the candidate Crin Antonescu, and additional portals such as banumuscel.ro, www.ccr.ro, www.gov.ro, www.just.ro, www.mae.ro, www.nicusordan.ro, www.senat.ro, and www.silviupredoiu.ro. Users attempting to access these pages encountered error messages and were unable to reach the services throughout the morning and early afternoon. The attacks were identified as DDoS floods that overwhelmed the servers with excessive traffic, causing temporary outages.
The National Directorate for Cyber Security (DNSC) confirmed the incident after receiving reports from independent journalists and monitoring traffic anomalies. DNSC issued a statement indicating that all listed websites had been restored and were fully operational by 14:00 local time on the same day. The agency emphasized that continuous monitoring remained in place to prevent further disruption.
The hacking collective NoName057, also referenced as DDOSIA/NoName057(16), publicly claimed responsibility for the attacks via a post on its official Telegram channel. In the message, the group stated that it had successfully sent “surprize DDoS” to the Ministry of Interior and Justice websites, framing the action as part of its broader pro‑Russian agenda. NoName057 described itself as a loosely organized network of digital activists that has conducted similar DDoS campaigns against Ukrainian, United States, and European targets since March 2022.
The group’s tactics include using Telegram for communication and claiming attacks, hosting the DDOSIA attack tool on GitHub, and disseminating propaganda content alongside technical details. No further technical details about the mitigation measures employed by Romanian authorities were disclosed in the public statements.