Law enforcement agencies across Europe and North America have launched a sweeping operation targeting the pro-Russian hacker group NoName057(16), known for widespread distributed denial-of-service (DDoS) attacks.
The coordinated effort, dubbed Operation Eastwood, took place from July 14–17 and involved authorities from 14 countries, including Germany, France, Spain, Lithuania, Sweden, the United States and others. The operation was led by Europol, with support from Eurojust, ENISA, and private sector partners ShadowServer and abuse.ch.
Authorities carried out 24 searches in six countries, arrested two individuals in France and Spain, and issued seven arrest warrants for Russian nationals – including six from Germany. Five suspects have been added to the EU’s Most Wanted list.
Over 100 computer systems used by the group were disrupted globally, with most of its central servers taken offline. In addition, 13 individuals were questioned and more than 1,000 group supporters – including 15 administrators – were formally notified about potential legal consequences.
Law enforcement agencies also reached out to hundreds of suspected sympathisers via messaging platforms, warning them of possible criminal liability. Most of these individuals are Russian speakers using automated tools to participate in DDoS attacks that form part of broader hybrid campaigns aimed at destabilising democratic institutions and undermining public trust.
Originally focused on Ukraine, NoName057(16) has increasingly targeted NATO countries and others supporting Ukraine. Attacks have included disruptions during NATO summits, as well as cyberattacks on Swedish banks and Swiss institutions during key Ukraine-related events. Germany reported 13 waves of attacks against approximately 230 entities since late 2023.
The group operates a custom-built botnet of hundreds of servers and has amassed a network of more than 4,000 supporters. Using pro-Russian forums and messaging apps, it distributes propaganda, attack instructions, and recruitment materials.
NoName057(16) has employed gamified tactics – including leaderboards, virtual badges, and cryptocurrency payments - to incentivise participation, particularly among younger users. Its messaging often centres around defending Russia or avenging political actions against it, tapping into emotionally charged narratives.
Newsletter
Every Friday morning.
