Russian Cyber Crime Network Disrupted
An international law-enforcement operation spanning North America and Europe has taken down a pro-Russian cybercrime group linked to thousands of attacks on Ukraine and its allies.
This major operation has dealt a significant blow to NoName057(16), a pro-Russian cyber group responsible for thousands of distributed denial-of-service (DDoS) attacks across Europe.
A joint international operation, called Eastwood, which is co-ordinated by Europol and Eurojust, hit NoName057(16) between 14th and 17th July .
Co-ordinated raids took place in 24 locations across a several European countries. Two suspects were arrested, one in France and another in Spain, while seven arrest warrants were issued, including six targeting individuals believed to be operating from Russia. Key components of the group’s command infrastructure were disabled and notifications were sent to over 1,000 group supporters, including 15 administrators, warning them of their potential legal liability.
Germany issued six warrants for the arrest of offenders living in the Russian Federation. Two of these persons are accused of being the main instigators responsible for the activities of "NoName057(16)". In total, national authorities have issued seven arrest warrants, which are directed, inter alia, against six Russian nationals for their involvement in the NoName057(16) criminal activities.
Authorities also searched homes in Czechia, Germany, Italy, Spain, Poland, and France, and questioned 13 individuals as part of the investigation.
Law enforcement and judicial authorities across Europe and the United States took simultaneous actions against offenders and infrastructure belonging to the pro-Russian cyber crime network. The investigation was supported by ENISA, as well as Belgium, Canada, Estonia, Denmark, Latvia, Romania and Ukraine. The private organistion ShadowServer assisted in the technical part of the operation. The Joint Cybercrime Action Taskforce (J-CAT) at Europol also supported the operation.
The actions led to the disruption of an offensive infrastructure consisting of over one hundred computer systems worldwide, while a major part of the group's central server infrastructure was taken offline.
NoName057(16) has been active since the onset of Russia’s war in Ukraine, launching politically motivated cyberattacks on government and financial websites across NATO-aligned states. Germany alone reported 14 waves of attacks affecting over 250 organisations. Sweden, Switzerland, and the Netherlands were also among the group’s recent targets.
Investigators say the group was structured more like an online hacktivist movement than a traditional cyber crime ring. Recruits were often sourced from gaming and hacking forums, where calls to action and attack tutorials were openly shared.
Many participants were incentivised with crypto-currency payments and motivated through gamified elements like leaderboards and digital badges, tools that particularly appealed to younger users.
Europol | I-HLS | AlJazeera | ABC | France24
Image: Ideogram
You Might Also Read:
If you like this website and use the comprehensive 8,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.
- Individual £5 per month or £50 per year. Sign Up
- Multi-User, Corporate & Library Accounts Available on Request
- Inquiries: Contact Cyber Security Intelligence
Cyber Security Intelligence: Captured Organised & Accessible
