Global operation led by Europol demonstrates success in dismantling a pro-Russian cybercriminal network
A significant international operation, codenamed **Operation Eastwood**, has successfully disrupted the pro-Russian cybercrime network **NoName057(16)**, responsible for numerous distributed denial-of-service (DDoS) attacks on Ukraine and several European countries allied with it, including members of NATO.
The operation, led by Europol and Eurojust, involved law enforcement agencies from multiple countries, including France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Czech Republic, the Netherlands, and the United States. Additional support came from Belgium, Canada, Estonia, Denmark, Latvia, Romania, and Ukraine.
The cyberattacks attributed to NoName057(16) targeted several European countries and sectors. In the Netherlands, they attacked municipalities and organizations linked to a NATO summit. In Sweden and Germany, they targeted government agencies, banking websites, and over 250 companies and institutions through multiple waves of attacks since late 2023. In Switzerland, attacks coincided with high-profile events, such as a Ukrainian video address to the Swiss Joint Parliament in June 2023 and the Peace Summit for Ukraine in June 2024.
Key outcomes of the operation include the disruption of a global attack infrastructure composed of over 100 computer systems worldwide, with a major part of the group's central server infrastructure taken offline. At least seven international arrest warrants were issued, with suspects primarily Russian nationals; six of these reside in Russia, including two identified as ringleaders. Arrests were made in France and Spain, and home searches were conducted across several European countries. Notification was also given to hundreds of individuals believed to support the group about their potential liability for involvement in the attacks.
NoName057(16) operated largely as a decentralized hacktivist collective of Russian-speaking ideological sympathizers. Members use automated tools, notably a specialized program called **DDoSia**, to launch DDoS attacks against targeted entities. They are motivated primarily by ideology but also receive cryptocurrency payments as incentives.
Western officials have accused Russia and its proxies of staging numerous cyberattacks across Europe since the invasion of Ukraine. Despite the volume and scale of attacks, the incidents were largely mitigated without causing significant disruption.
In summary, Operation Eastwood represents a significant success in countering pro-Russian cybercrime activities aimed at destabilizing European support for Ukraine by incapacitating NoName057(16)'s attack infrastructure and targeting its leadership and supporters worldwide.
- The cyberattacks, carried out by the pro-Russian cybercrime network NoName057(16), were global in nature, extending beyond Ukraine to targets in sectors such as government agencies, banking websites, and multiple companies and institutions in several European countries including the Netherlands, Sweden, Germany, and Switzerland.
- The politics of cybersecurity in the context of war-and-conflicts, like the ongoing invasion of Ukraine, have been highlighted once again, with Western officials accusing Russia and its proxies of staging numerous cyberattacks across Europe.
- In the realm of crime-and-justice, Operation Eastwood, a significant international operation led by Europol and Eurojust, resulted in the disruption of a global attack infrastructure used by NoName057(16) and the issuance of at least seven international arrest warrants for Russian nationals, with arrests made in France and Spain.
