International operation disrupts pro-Russian hacker group NoName057(16)

European and U.S. law enforcement have disrupted the operations of NoName057(16), the pro-Russian hacker group known for launching large-scale distributed denial-of-service (DDoS) attacks against Ukraine and its allies.

In a joint international effort called Operation Eastwood, police targeted more than 100 servers allegedly used by the group and took down a major part of its central infrastructure, Europol said in a statement on Wednesday.

Germany issued six arrest warrants for Russian nationals believed to be involved in the group’s leadership, including two suspected ringleaders. Since November 2023, German authorities have recorded 14 waves of attacks affecting more than 250 entities.

In total, seven international arrest warrants have been issued, with some suspects now listed on Europol’s “Most Wanted” website. Authorities also contacted more than 1,100 alleged supporters of NoName057(16) — primarily Russian-speaking sympathizers — via encrypted messaging apps, warning them of potential criminal liability under national laws.

The group used pro-Russian channels, forums, and niche chat groups on social media and messaging apps to share calls to action, post tutorials and updates, and to recruit volunteers. Participants often invited friends or contacts from gaming or hacking forums, forming tight-knit recruitment circles.

Volunteers were rewarded with cryptocurrency, public recognition, and digital badges — similar to how rewards work in video games. Officials said these tactics helped attract and keep younger people involved by promoting the idea that they were defending their country online.

NoName057(16) emerged at the onset of Russia’s full-scale invasion of Ukraine in 2022 and is known for coordinating relatively simple but disruptive DDoS attacks, often carried out with help from hundreds of volunteers. In addition to a network of more than 4,000 supporters, the group built a botnet comprising several hundred servers to amplify its attacks, authorities said.

In July 2023, Spanish police arrested three alleged members of the group suspected of participating in DDoS attacks targeting public institutions and strategic sectors in Spain and other NATO countries.

The group has mainly targeted European countries, including Poland, Czechia, Lithuania, and Italy. Swiss authorities said the hackers were behind cyberattacks during President Volodymyr Zelensky’s address to the Swiss Parliament in 2023 and the Ukraine Peace Summit in 2024. Dutch officials linked the group to a recent attack during the NATO summit in The Hague.

While most attacks caused minimal disruption, investigators described the group’s decentralized model and use of botnets as an escalating threat.

Europol said investigations into NoName057(16)’s broader network remain ongoing.