Pro-Russian hackers target European officials, offer rewards for personal information

Pro-Russian hackers have published the personal information of Italian Foreign Minister Antonio Tajani and other senior European officials on the dark web, offering cryptocurrency rewards for additional details about them and their families.

Tajani said Saturday the campaign was intended to intimidate him over Italy's support for Ukraine.

"For days now, cybercriminals have been posting my personal data on the dark web and looking for more information, effectively exposing me to new threats and intimidation," Tajani wrote Saturday on X. "They are also targeting my family."

The campaign has been linked to NoName057(16), a pro-Russian hacktivist group best known for launching cyberattacks against Ukraine and European countries that support Kyiv.

The group has published personal information about 18 European politicians, law enforcement officials and journalists on a dedicated dark web site, according to cybersecurity researchers who examined the material.

The profiles contain phone numbers, email addresses, social media accounts and, in some cases, home addresses. The hackers also offered cryptocurrency payments to anyone who provided additional personal information about the targets or their relatives.

Among those reportedly targeted are Eurojust President Michael Schmid, Europol's European Cybercrime Centre chief Edvardas Sileris and German Federal Criminal Police Office President Holger Münch. The list also includes Rome prosecutor Francesco Lo Voi, Italian Postal Police chief Ivano Gabrielli and Paolo Tassan-Zanin, mayor of Aviano, an Italian town that hosts a major U.S. and NATO air base. Three German journalists who have investigated Russian hackers and influence operations were also targeted.

The campaign appears to be retaliation for an international law enforcement action in July 2025 that disrupted NoName057(16)'s infrastructure. The operation, coordinated by Europol and Eurojust and involving authorities from 12 countries, took more than 100 servers offline and targeted the group's network of supporters.

Several people now appearing on the hackers' list were involved in the investigation, including Lo Voi and Gabrielli, according to Italian media reports. Italian prosecutors are investigating the publication of the personal information.

Russia has denied involvement. Asked about the incident by Italian news agency ANSA, the Russian Embassy in Italy dismissed the allegations.

"We have heard that drugs are being traded on the dark web. So, we stay away. How Tajani ended up there, it is to be asked who is hanging out in those parts," Russian officials said.

Tajani said Sunday the Group of 7 foreign ministers would discuss recent cyberattacks attributed to pro-Russian groups at a meeting in Paris on Monday and Tuesday, including possible joint measures to counter such threats. He stressed that he was not accusing the Russian government of directing the attacks.

"I said the hackers are pro-Russian. I did not say that the Russian government is responsible," Tajani said. "If I had proof of Russian government involvement, I would say so."

NoName057(16) emerged after Russia's full-scale invasion of Ukraine in 2022 and has repeatedly targeted government agencies, banks and other organizations in countries supporting Kyiv.

The group primarily conducts distributed denial-of-service (DDoS) attacks, which overwhelm websites and online services with traffic to make them inaccessible. It recruits volunteers through Telegram and offers cryptocurrency rewards for participating in attacks.

Researchers have observed the group expanding its activities beyond website disruptions. In an October report, cybersecurity firm DarkOwl said NoName057(16) had begun operating a paid information-gathering platform on the Tor network and publishing a list of foreign individuals it considered hostile to Russia.

The group has also increasingly claimed attacks against industrial systems, although those claims have not always been independently verified.

“NoName057(16) remains one of the most prolific hacktivist actors observed, sustaining a steady tempo of DDoS claims against NATO and EU states supporting Ukraine,” researchers said. 

Despite the international crackdown last year, the group has continued to claim attacks against European targets, including Italian government institutions and local authorities.

In October, Italy's Foreign Ministry was targeted in a cyberattack, although officials said its defenses prevented any disruption. Later that month, the group claimed attacks against several Italian municipalities and private companies.

Earlier this month, NoName057(16) and another pro-Russian group claimed responsibility for cyberattacks that reportedly disrupted industrial refrigeration systems at European supermarkets. Those claims have not been independently verified, and researchers have cautioned against attributing the incidents without further technical evidence.