Western intelligence agencies have dismantled a pro-Russian hacker group that has caused wide spread havoc in Europe. The group – NoName057(16) – is responsible for numerous cyber attacks on critical infrastructure, including electricity and public transport across the continent.
Although the hacker collective originally targeted Ukraine, its activities have increasingly centred on Western allies of Kyiv – many of whom are NATO members. In 2023 and 2024, the criminal network took part in attacks against Swedish authorities and bank websites. Since November 2023, Germany has experienced 14 separate waves of attacks targeting more than 250 companies and institutions.
Most recently, the Dutch authorities confirmed that an attack linked to this network was carried out during the latest NATO summit in the Netherlands. Law enforcement and judicial officials from several European countries and the US carried out a joint operation dubbed Eastwood between July 14 and 17.
The participating countries included the Czech Republic, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands and the United States. The operation successfully disrupted an attack-infrastructure consisting of over one hundred computer systems worldwide, while a major part of the group’s central server system was taken offline.
National authorities have issued seven arrest warrants, including for six Russian nationals, for their involvement in the NoName057(16) criminal activities. Investigators say the group was an ideological criminal network that supported Russia’s war aims in Ukraine.
The hacker collective is believed to have around 4,000 supporters and not only lunched repeated DDoS attacks, but was also able to construct their own botnet made up of several hundred servers.
Participants were paid in cryptocurrency, which incentivised sustained involvement and attracted opportunists. Europol has warned that state actors like Russia are driving an increase in politically motivated cyber-attacks and sabotage of infrastructure and public institutions in the EU.
An 80-page report released in March by the agency outlined how “hybrid threat” actors have established a “shadow alliance” with organised criminal gangs in Europe to try to destabilise the functioning of the EU and its member states.
The EU commissioner for internal affairs and migration Magnus Brunner said at the launch of the report: “Criminal networks that work on behalf of foreign powers – that is something new.
“Some threats enter our union in less than a second as an encrypted message, for instance, ordering an assassination of a rival drug dealer. Some threats enter in a few days, like a bus full of migrants, paid by the Russians.”