Global operation disrupts pro-Russian hacker group behind cyber attacks on Ukraine and allies

A joint global operation coordinated by Europol and Eurojust successfully disrupted the operations of a pro-Russian hacker group known for launching large-scale denial-of-service attacks against Ukraine and its allies.

 

In a press release, Europol said that between July 14 and 17, a joint international operation, named “Eastwood” was launched that targeted the cyber crime network NoName057(16). 

 

The operation, coordinated by Europol and Eurojust, was supported by law enforcement authorities from 12 other countries including, Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands and the United States.

 

The NoName057(16) hacking group emerged in March 2022 following the war in Ukraine. While the hacker group initially targeted organisations in Ukraine, it quickly shifted its focus on attacking countries that support Ukraine in the ongoing war against Russia, many of which are members of NATO. 

 

“In 2023 and 2024, the criminal network took part in attacks against Swedish authorities and bank websites. Since investigations started in November 2023, Germany saw 14 separate waves of attacks targeting more than 250 companies and institutions.

 

“In Switzerland, multiple attacks were also carried out in June 2023, during a Ukrainian video-message addressed to the Joint Parliament, and in June 2024, during the Peace Summit for Ukraine at Bürgenstock,” Europol said in its press release.

 

During operation Eastwood, two arrests were made, one in France and one in Spain.  Furthermore, seven European arrest warrants were issued, six by Germany, and one by Spain. Authorities also warned 1,100 participants and 17 administrators via Telegram of potential criminal liability.

 

The warrants issued by Germany targeted individuals believed to be in Russia, including two suspected to be the group’s main operators.

 

Europol described Operation Eastwood as a major setback for NoName057(16), though investigations into the group’s wider network are still ongoing.