International Operation Disrupts Pro-Russian Cybercriminal Gang NoName057(16)

Between July 14 – 17, a co-ordinated international law enforcement operation effort led by Europol and Eurojust, targeted and disrupted the pro-Russian cybercrime network NoName057(16). Authorities from 12 core countries, including the US, Germany, France, and the Netherlands, conducted actions against the group’s infrastructure and members, with support from seven additional countries and agencies such as ENISA, ShadowServer, and abuse.ch.

Key results:

• 100+ servers dismantled worldwide.
• Major part of NoName057(16)’s infrastructure taken offline.
• Seven arrest warrants issues (Six by Germany, one by Spain).
• Two arrests in France and Spain.
• 24 property searches across Europe.
• 13 individuals questioned.
• 1000+ supporters notified, including 15 administrators.

Germany named six Russian nationals as wanted suspects, two of whom are considered ringleaders. Five profiles were added to the EU Most Wanted List.

NoName057(16) who was an ideologically motivated group supporting Russia’s war on Ukraine, has orchestrated waves of DDoS attacks across NATO countries. Victims have included Swedish authorities, Swiss government events, the recent NATO summit in the Netherlands. The group used platforms like DDoSia to simplify attacks, recruited via chat apps and forums, and incentivized involvement with cryptocurrency rewards, badges, and leaderboards.

Europol led the operation and technical support, including cryptocurrency tracing and digital forensics. Eurojust enabled cross-boarder judicial co-operation, taking out multiple European Investigation Orders. Over 30 co-ordination meetings and two operational sprints ensured alignment between the jurisdictions.

For more information on hacktivist groups (including a mention of NoName057(16)!) listen to this episode of The Dark Dive Podcast.