Europol adds Spanish academic suspected of aiding pro-Russian hackers to most wanted list

Europol has placed a former Spanish university professor accused of helping the pro-Russian hacker group NoName057(16) on its most wanted list, according to Spain’s National Police.

Spanish national Enrique Arias Gil, 37, is suspected of gathering information on Spain’s critical infrastructure and members of its security forces to facilitate cyberattacks. He is also accused of threatening journalists and business leaders who supported Ukraine.

According to local media reports, Arias Gil is currently in Russia, where he travelled on a scholarship from the Russian House, a government-funded cultural institute. A National Court judge has issued an international arrest warrant, though police sources told local media that Moscow was unlikely to cooperate.

Arias Gil, who formerly lectured on political science and is the author of books on extremism, is wanted on charges including computer damage for terrorist purposes, membership in a criminal organization and glorifying terrorism.

Arias Gil reportedly runs a Spanish-language Telegram channel called Desinformador Ruso (“Russian Disinformer”), set up in March 2024, which has posted messages about cyberattacks claimed by NoName057(16) and another pro-Russian group, Z-Pentest. 

Two days after being declared wanted, Arias Gil posted a defiant message on his channel, demanding that Spanish law enforcement drop the case within 10 hours or face the release of alleged kompromat on senior officials. “I will finish off all the rats and cockroaches in the Spanish intelligence’s underworld, one by one,” he added. 

Allies of NoName057(16) have called the case against Arias Gil a “witch hunt,” saying he merely reposted content. 

NoName057(16) was formed at the onset of Russia’s invasion of Ukraine in 2022 to launch disruptive but low-level distributed denial-of-service (DDoS) attacks against government websites and private companies in NATO states that support Kyiv. The group is believed to rely on thousands of volunteers and a botnet of hundreds of servers.

In July, European and U.S. authorities disrupted its infrastructure in an operation codenamed Eastwood, targeting more than 100 servers and warning some 1,100 suspected supporters. Spanish police arrested three alleged members of the group in 2023 on suspicion of attacking institutions and strategic sectors in Spain and other NATO countries.

Spanish law enforcement called NoName hackers “one of the most active groups” attacking Ukraine and its allies since Russia’s invasion.