Unnamed Pro-Russian Hacking Collective Forcibly Shuts Down Server Operations - Pro-RussianHackers' Server Disabled
In a significant international operation named Operation Eastwood, law enforcement agencies from across the globe have successfully dismantled the infrastructure of the pro-Russian hacker group NoName057(16). The group, notorious for carrying out politically motivated cyberattacks, primarily Distributed Denial of Service (DDoS) attacks, against Western countries supporting Ukraine, has been under immense pressure since the operation unfolded between July 14 and 17, 2025.
The operation involved judicial and police authorities from numerous countries, including Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands, and the United States, as well as support from EU agencies Europol and Eurojust.
NoName057(16) has reportedly garnered over 4,000 supporters who were recruited and coordinated via social media, forums, Telegram groups, niche chat apps, and pro-Russian channels. The group used platforms like DDoSia to reduce technical entry barriers, enabling volunteers to participate with simplified hacking tools and tutorials. Participants were incentivized with cryptocurrency payments and a gamified system that provided status within the community.
The group's messaging heavily emphasized a narrative of defending Russia or avenging political events related to the Russian war against Ukraine, often targeting younger offenders.
Two arrests were made, one in France and one in Spain, and seven arrest warrants were issued—six by Germany and one by Spain. Authorities conducted 24 house searches across several countries, including Germany, France, Czechia, Italy, Poland, and Spain. Thirteen individuals were questioned, and more than 1,000 supporters, including 15 administrators, were notified via messaging apps about their legal responsibilities.
Evidence secured during the operation points towards a centralized "command and control" structure based in Russia. The operation was supported technically by private organizations ShadowServer and abuse.ch, as well as coordination from ENISA and contributions from Belgium, Canada, Estonia, Denmark, Latvia, Romania, and Ukraine.
Benjamin Krause, head of the Central Office for Combating Cybercrime at the General Public Prosecutor's Office in Frankfurt, stated that those responsible, members, and supporters of the group are being pursued as a criminal organization. Federal Minister of the Interior Alexander Dobrindt (CSU) commented on the measures, stating that they successfully struck a blow against the hacker network.
In Germany, three objects allegedly attributed to supporters of NoName057(16) were searched, with two in Bavaria and one in Berlin. The targets of the attacks were reportedly harbors, banks, and authorities. The evidence secured is currently being evaluated.
Since the beginning of the investigation in November 2023, Germany has been the target of a total of 14 attack waves. Twelve countries, including European states and the USA, were involved in the international action. Europol coordinated the action, reporting a series of cyberattacks, mainly targeting NATO member states and their support for Ukraine. According to Dutch authorities, the hackers were also responsible for several DDoS attacks during the NATO summit in June in The Hague.
NoName057(16) is an ideologically driven hacktivist collective that supports Russia and carries out cyberattacks in the context of the Russia-Ukraine conflict. The dismantling of the group's infrastructure and leadership marks a major international law enforcement success against this group in July 2025.
- The international operation, Operation Eastwood, dismantled the pro-Russian hacker group NoName057(16)'s infrastructure, which included judicial and police authorities from EC countries such as Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands, and the United States, as well as support from EU agencies Europol and Eurojust. their primary target was Western countries supporting Ukraine.
- The NoName057(16) group used various platforms like social media, forums, Telegram groups, niche chat apps, and pro-Russian channels for recruitment and coordination. Members were incentivized with cryptocurrency payments and a gamified system that provided status within the community.
- As a result of the operation, two arrests were made, one in France and one in Spain, and seven arrest warrants were issued—six by Germany and one by Spain. The operation also involved conductig 24 house searches across several countries and questioning thirteen individuals. Evidence secured during the operation points towards a centralized "command and control" structure based in Russia.
