Europol Strikes Down Pro-Russian Hacktivist Group NoName057(16) in Major Cyber Operation

In a significant international law enforcement effort dubbed "Operation Eastwood," Europol and Eurojust have successfully disrupted the pro-Russian hacktivist group NoName057(16). This coordinated action targeted the group's infrastructure and members, who have been responsible for numerous distributed denial-of-service (DDoS) attacks across Europe and against entities supporting Ukraine since early 2022.

International Crackdown Halts Pro-Russian Hacktivist Group

Operation Eastwood, conducted between July 14 and 17, 2025, involved law enforcement and judicial authorities from 12 countries, including Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands, and the United States. The operation aimed to dismantle the cybercrime network and its capabilities.

Key takeaways from Operation Eastwood include:

• Infrastructure Disruption: Over 100 servers worldwide were disrupted, and a major portion of the group's central server infrastructure was taken offline.

• Arrests and Warrants: Two arrests were made (one in France, one in Spain), and seven international arrest warrants were issued, with six originating from Germany. Two primary operators, believed to reside in Russia, are among those targeted by warrants.

• Searches and Questioning: Twenty-four house searches were conducted across multiple jurisdictions, and 13 individuals were questioned.

• Warnings to Supporters: Over 1,000 supporters and 17 administrators were notified via messaging apps about their potential criminal liability for participating in the group's activities.

NoName057(16)'s Modus Operandi and Targets

NoName057(16), active since March 2022, primarily consists of Russian-speaking sympathizers. The group leverages Telegram channels, specialized forums, and messaging applications to coordinate attacks and recruit members. They utilize the open-source "DDoSia" platform and a self-built botnet of several hundred servers to amplify their attack capacity.

To incentivize participation, NoName057(16 employed gamification techniques, including leaderboards, badges, and cryptocurrency rewards. This strategy, often targeting younger individuals, was reinforced by a narrative of defending Russia or avenging political events.

The group initially focused on Ukrainian websites but expanded its targets to include countries in NATO and organizations supporting Ukraine. Notable attacks include:

• European Elections: Attacks during the European elections, affecting Swedish government agencies and bank websites.

• Germany: 14 waves of attacks targeting over 250 companies and institutions since November 2023.

• Switzerland: Multiple attacks in June 2023 during a Ukrainian presidential video message to the Swiss parliament, and in June 2024 during the Peace Summit for Ukraine.

• Netherlands: An attack during the NATO summit in June 2025.

While Operation Eastwood delivered a significant blow to NoName057(16), authorities acknowledge that the group's core members residing in Russia may attempt to rebuild their infrastructure. However, the operation has severely hampered their immediate capabilities and sent a clear message to hacktivist groups engaging in cyber warfare.

As cyber threats become increasingly sophisticated, your security strategy must evolve to keep pace. BetterWorld Technology offers adaptive cybersecurity solutions that grow with the threat landscape, helping your business stay secure while continuing to innovate. Reach out today to schedule your personalized consultation.

Sources

• Pro-Russian DDoS group NoName057(16) disrupted by international law enforcement operation, CyberScoop.

• Pro-Russian Cybercrime Network Demolished in Operation Eastwood, Infosecurity Magazine.

• Operation Eastwood disrupted operations of pro-Russian hacker group NoName057(16), Security Affairs.

• Europol disrupts pro-Russian NoName057(16) DDoS hacktivist group, BleepingComputer.

• Europol Disrupts NoName057(16) Hacktivist Group Linked to DDoS Attacks Against Ukraine, The Hacker News.