Hacker groups claim DDoS attacks on French targets

Between October 15 and 17, 2026, several hacker groups claimed responsibility for distributed denial-of-service (DDoS) attacks targeting French websites, particularly in the administration, defense, and energy sectors. These attacks disrupted access to critical services by overwhelming servers with traffic.

Multiple sectors affected by cyberattacks

The attacks targeted a range of organizations, including EDF, Eurenco, Renault Trucks, the SGDSN, local authorities, and maritime transport actors. The hackers highlighted sectors such as public services, transportation, energy, and sensitive industrial activities as primary targets.

Notable hacker groups identified

Three groups stood out in the information collected: NoName057(16), Dark Storm, and CyberTroll Team. One of these groups, Dark Storm, offers a commercial service that provides DDoS attacks on demand, indicating a potential shift toward monetizing cyberattacks.

French authorities warned of suspicious activity

French administrations and targeted industrial actors had been alerted by ZATAZ, a cybersecurity firm, to strange messages and digital behaviors from Russian-speaking hackers. These alerts occurred just before the cyberattacks, which coincided with disruptions in refrigeration units at hundreds of stores in France, Belgium, and the Netherlands.

Multiple claims across different targets

On October 15 and 16, the hackers published multiple claims targeting a variety of sectors. These included the maritime vocational training center Corsica Linea, the city of Saint-Malo, and XSun, a French drone design company. In the energy sector, three interfaces associated with EDF were also mentioned.

CyberTroll Team claims to have disrupted SGDSN

CyberTroll Team, a newly emerged group that affiliated itself with NoName057(16), claimed to have made the SGDSN’s website inaccessible on October 15. The group also targeted Renault Trucks, O Technologie, and an authentication portal for Business France in subsequent claims.

Other sectors and locations targeted

Additional claims targeted the departments of Vienne and Gers, the city of Brest, and Eurenco, a manufacturer of explosives. The claims also mentioned Genavir, an operator of oceanographic ships, and the Compagnie Maritime Nantaise. The Grand Port Maritime de La Rochelle and Corsica Linea were cited again in these announcements.

Check-Host used to verify attacks

All the reported unavailability of websites was observed by ZATAZ. The hackers used Check-Host, a tool that tests the accessibility of domains or servers from various locations. This tool can show temporary unavailability but does not necessarily confirm the cause of an attack.

Dark Storm offers offensive services for sale

Dark Storm, in addition to claiming attacks, offers a catalog of offensive services for sale. The group’s Black Storm (DN) catalog includes various DDoS attack options, with prices ranging from 20 dollars for a three-hour intervention to 100 dollars for a full day. ZATAZ notes that the group has recently expanded its services to include database extraction from websites.

Coordination questions arise

The simultaneous presence of multiple hacker groups in the claims raises questions about their coordination. While each group appears to operate independently, the scale and timing of the attacks suggest potential collaboration or shared objectives among the different actors.