Operation Eastwood disrupted operations of pro-Russian hacker group NoName057(16)
Operation Eastwood disrupted operations of pro-Russian hacker group NoName057(16)
July 16, 2025
International law enforcement operation disrupted the activities of the pro-Russia hacking group NoName057(16).
European and U.S. authorities disrupted the activities of the pro-Russian hacktivist group NoName057(16) in Operation Eastwood.
“Between 14 and 17 July, a joint international operation, known as Eastwood and coordinated by Europol and Eurojust, targeted the cybercrime network NoName057(16). Law enforcement and judicial authorities from Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands and the United States took simultaneous actions against offenders and infrastructure belonging to the pro-Russian cybercrime network.” reads the press release published by Europol. “The investigation was also supported by ENISA, as well as Belgium, Canada, Estonia, Denmark, Latvia, Romania and Ukraine. The private parties ShadowServer and abuse.ch also assisted in the technical part of the operation.”
Operation Eastwood disrupted NoName057(16)’s infrastructure, taking down over 100 systems and key central servers. Authorities issued seven arrest warrants, including six targeting Russian nationals, two of whom are accused as the main instigators. Suspects are internationally wanted, with five listed on the EU Most Wanted site. Hundreds of group supporters were warned about their legal liability for aiding the group’s DDoS attacks, often driven by pro-Russian ideology.
Operation Eastwood struck a major blow to the pro-Russian hacker group NoName057(16). Authorities carried out two arrests, one in France and another in Spain, and issued seven arrest warrants, six by Germany and one by Spain. Law enforcement conducted 24 house searches across multiple countries, including Czechia, France, Germany, Italy, Spain, and Poland. Thirteen individuals were questioned, and over 1,000 supporters, 15 of them administrators, were notified via messaging apps about their legal responsibility.
The pro-Russian hacker group NoName057(16) has ramped up DDoS attacks against countries supporting Ukraine, many of them NATO members. Since 2023, they’ve targeted Swedish government and banking sites, hit over 250 German entities in 14 attack waves, and disrupted events in Switzerland, including the Ukraine Peace Summit. Dutch authorities also linked them to an attack during the recent NATO summit. Thankfully, all incidents were mitigated without major disruptions.
The pro-Russian hacker group has over 4,000 supporters and employed a self-built botnet composed of hundreds of servers. The group spreads propaganda and recruits through social media, forums, and niche chat apps. Using platforms like DDoSia, they lower technical barriers.
“Participants were also paid in cryptocurrency, which incentivised sustained involvement and attracted opportunists. Mimicking game-like dynamics, regular shout-outs, leader boards, or badges provided volunteers with a sense of status.” concludes the press release. “This gamified manipulation, often targeted at younger offenders, was emotionally reinforced by a narrative of defending Russia or avenging political events.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Operation Eastwood)
