Europol coordinated an operation with Eurojust that targeted the pro-Russian cybercrime network NoName057(16)

In a significant victory against cyber organized crime, Europol, in close coordination with Eurojust and law enforcement agencies from over a dozen countries, has dismantled key infrastructure and arrested individuals linked to NoName057(16), a prominent pro-Russian cybercrime network. The operation, codenamed “Eastwood,” marks a concerted international effort to disrupt groups responsible for politically motivated cyberattacks.

NoName057(16) has been active since March 2022, primarily conducting Distributed Denial of Service (DDoS) attacks against government institutions, critical infrastructure, and private companies in countries supporting Ukraine. Initially focusing on Ukrainian targets, the group shifted its attention to NATO member states and other nations providing aid to Ukraine, often aligning their attacks with significant political events or diplomatic summits. Their modus operandi involved recruiting “volunteers” through pro-Russian Telegram channels and forums, often incentivizing participation with cryptocurrency payments and gamified elements like leaderboards and badges. This recruitment strategy, Europol noted, frequently targeted younger individuals, manipulating them with narratives of defending Russia.

The operation, which took place between July 14 and 17, 2025, involved simultaneous actions in Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands, and the United States. As a result, over 100 servers worldwide were disrupted, and a major portion of the group’s central server infrastructure was taken offline. Two arrests were made in France and Spain, with seven arrest warrants issued, including six by German authorities for individuals believed to be key instigators residing in the Russian Federation. Additionally, 24 house searches were conducted, and 13 individuals were questioned.

Europol played a pivotal role in facilitating information exchange and coordinating operational activities, acting as a central hub for communication between national authorities. Eurojust ensured the coordination of judicial activities, enabling the execution of Mutual Legal Assistance requests and European Investigation Orders across borders. Beyond arrests and infrastructure takedowns, over 1,000 individuals identified as supporters and 17 administrators of the network were notified of their criminal liability via messaging apps, sending a clear message about the consequences of participating in such activities.

While NoName057(16) has, in some instances, reportedly resumed limited activities, “Operation Eastwood” represents a substantial blow to the group’s capabilities and serves as a powerful testament to the effectiveness of international cooperation in combating complex cyber threats. The coordinated response underscores the commitment of global law enforcement to hold cybercriminals accountable, regardless of their geopolitical motivations.