Large-scale operation against pro-Russian hacker network carried out in Europe: details

Law enforcement agencies from over ten European countries, as well as Canada and the USA, have carried out a joint operation targeting the large-scale network of pro-Russian hackers NoName057(16). This is reported by UNN with reference to Europol.

Details

From July 14 to 17, a joint international operation "Eastwood" was conducted, coordinated by Europol and Eurojust, aimed at the cybercrime network NoName057(16). Law enforcement and judicial authorities of the Czech Republic, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands, and the USA simultaneously took action against the criminals and infrastructure of the pro-Russian cybercrime network. The investigation was also supported by ENISA, as well as Belgium, Canada, Estonia, Denmark, Latvia, Romania, and Ukraine.

As a result of the operation, the infrastructure for carrying out cyberattacks, consisting of over a hundred computer systems worldwide, was destroyed.

German law enforcement, in turn, issued six arrest warrants for the perpetrators, two of whom are accused of organizing the activities of NoName057(16). They, along with another suspect, have been placed on an international wanted list.

In total, national authorities issued seven arrest warrants, targeting, among others, six Russian citizens for their involvement in the criminal activities of NoName057(16).

The hackers of the NoName057(16) group initially carried out operations against Ukraine, but later expanded their activities against EU and NATO countries.

Overall results of Operation "Eastwood"

• 2 arrests (1 preliminary arrest in France and 1 in Spain)
• 7 arrest warrants issued (6 by Germany and 1 by Spain)
• 24 house searches (2 in Czech Republic, 1 in France, 3 in Germany, 5 in Italy, 12 in Spain, 1 in Poland)
• 13 people interviewed (2 in Germany, 1 in France, 4 in Italy, 1 in Poland, 5 in Spain)
• Over 1000 supporters, 15 of whom are administrators, were informed of their legal responsibility via a messaging application.
• Over 100 servers worldwide taken down
• The main part of NoName057(16)'s core infrastructure has been shut down

It is noted that the criminals associated with the cybercrime network NoName057(16) primarily targeted Ukraine, but then shifted their focus to attacking countries that support Ukraine in its defense against Russian aggressive war, many of which are NATO members.

According to Europol, national authorities have reported a number of cyberattacks related to the criminal activities of NoName057(16). In 2023 and 2024, the criminal network participated in attacks on Swedish authorities and banking websites. Since the start of the investigation in November 2023, 14 separate waves of attacks targeting more than 250 companies and institutions have been recorded in Germany.

In Switzerland, several attacks were also carried out in June 2023 during Ukraine's video address to the Joint Parliament and in June 2024 during the Peace Summit for Ukraine in Bürgenstock. Recently, Dutch authorities confirmed that an attack related to this network was carried out during the last NATO summit in the Netherlands. 

Recall

The pro-Russian hacker group claimed responsibility for a cyberattack that shut down the website of the Spanish company Santa Barbara Systems, which is modernizing Leopard tanks for Ukraine.

Russian hackers attacked several Swiss government websites during Ukrainian President Volodymyr Zelenskyy's visit to the World Economic Forum in Davos.

A pro-Russian hacker group continued attacks on Swiss government and organizational websites ahead of the Peace Summit on Ukraine.

A group of Russian websites publishes confidential data of Ukrainian military personnel and their families, using technical services in Slovakia. The goal is public humiliation and intimidation, which is part of information-psychological warfare.