EU Authorities Take Down Pro-Russian Hacktivist Collective

A joint operation by European police agencies led to the arrests of two suspected operators behind a prolific pro-Russian hacking group. The authorities also seized multiple networks associated with the group, known for DDoS attacks against Western countries.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Europol on Wednesday disclosed that it seized over 100 servers used by NoName057(16), aka NoName, which the agency described as an “ideological criminal network” supporting for the Russian Federation. The group has been conducting distributed-denial-of-service attacks against European Union nations since the invasion of Ukraine by Russia in 2022.

The crackdown was coordinated by over 10 enforcement agencies in Europe on Monday. Authorities in France and Spain arrested two suspected NoName057(16) operators. The German Public Prosecutor General’s Office of Frankfurt and the Federal Criminal Police Office or the BKA also issued arrest warrants against six Russian nationals suspected of running NoName057(16) DDoS attacks against German companies.

The targeted individuals include Andrey Muravyov, Maxim Lupin, Olga Evastratova, Mihail Burlakov and Anrej Avrosimow for their role in running the hacking collective and DDoSia, a platform developed by the group that was used to run DDoS attacks.

“Organized DDoS campaigns can have serious consequences, including the population’s sense of security. They must therefore be consistently prosecuted and prevented where possible,” BKA President Holger Münch said.

The six suspects have been added to the EU’s most wanted list. Additionally, the Spanish police also issued an arrest warrant against an unidentified NoName operator.

NoName057(16) was one among the four groups that surfaced in 2022 following the Russian invasion of Ukraine. Other pro-Kremlin groups include Anonymous Russia, Phoenix and People’s Cyber Army.

NoName primarly targeted Ukrainian organizations, and has targeted government agencies and the banking sector in Sweden, Switzerland and Poland, often in response to assistance offered by the countries to Ukraine.

Europol estimates the group has over 4,000 supporters. The group primarily operated over the instant messaging app Telegram to share tutorials, release updates and recruit volunteers.

“Volunteers are often invited friends or contacts from gaming or hacking forums, forming small recruitment circles. These actors used platforms like DDoSia to simplify technical processes and provide guidelines, enabling new recruits to become operational quickly,” Europol said.

On Wednesday, NoName’s Telegram account appeared to have gone offline.

The latest action against the hacking group comes as the EU expects Russia to increase its cyberattacks against the trading bloc in the coming years.

Russia is mainly focused on leading hybrid threats, combining tactics including interference in the information sphere, cyberattacks, sabotage, espionage and arbitrary detention of nationals, the French government said in its latest national security strategy. The report predicted that by 2030 France and Europe will face the risk of “open warfare” with Russia (see: France Says Russia Is Top Threat, Warns of ‘Open Warfare’).