Pro-Russian cyber intruders forced server shutdown
In a significant joint effort, law enforcement agencies from 12 countries, including Germany, France, Spain, Italy, Poland, Finland, Lithuania, Sweden, Switzerland, the Netherlands, the United States, and agencies such as Europol, Eurojust, and ENISA, have disrupted the activities of the hacker group NoName057(16). This operation, named Operation Eastwood, has been ongoing since July 2025.
The hacker group, described as an ideologically driven hacktivist collective supporting Russia and carrying out cyberattacks in the context of the Russia-Ukraine conflict, has been causing disruption in Germany since November 2023. The group has targeted ports, banks, and government agencies, with Germany experiencing 14 attack waves, some of which lasted several days. According to Dutch authorities, the hackers were also responsible for several DDoS attacks during the NATO summit in The Hague in June.
The group's support network comprises over 4,000 users, and they have built a self-managed botnet consisting of several hundred servers to carry out DDoS attacks. This botnet was shut down as part of the joint action against the hacker group.
The operation has resulted in two arrests, one each in France and Spain, and a total of seven international arrest warrants were issued, six by Germany and one by Spain. Raids were conducted in Bavaria and Berlin, and a total of 24 house searches were carried out internationally, with 13 individuals being questioned. Over 100 servers used by the group’s botnet were taken down worldwide, significantly undermining their operational capacity.
The group recruited volunteers via Telegram channels, forums, and niche chat apps, often employing gamification tactics such as leaderboards, badges, and cryptocurrency rewards to motivate sustained participation. This gamified structure targeted many younger participants by promoting a narrative of defending Russia or retaliating for political events.
The main goal of the attacks on German targets was to gain media attention and influence political and/or societal decisions in Germany. Spanish authorities have also issued an arrest warrant for suspects linked to the hacker group. Currently, the seized evidence from the searches is being evaluated.
The German Federal Interior Minister, Alexander Dobrindt (CSU), commented on the measures, stating that they successfully struck a blow against the hacker network. This operation demonstrates a high level of international cooperation aiming to curb politically motivated cyberattacks originating from NoName057(16).
- The activities of the ideologically driven hacktivist collective, NoName057(16), which has been causing disruption in Germany's cybersecurity landscape since November 2023, were disrupted as part of Operation Eastwood.
- The group, known for its support of Russia and involvement in the Russia-Ukraine conflict, targeted ports, banks, and government agencies, with Germany experiencing 14 attack waves and the group responsible for DDoS attacks during the NATO summit in The Hague in June.
- The operation, involving law enforcement agencies from 12 countries and agencies like Europol, Eurojust, and ENISA, resulted in two arrests, one each in France and Spain, and the shutdown of the hackers' self-managed botnet, significantly reducing their operational capacity in the realm of technology and crime-and-justice.
