Pro-Russian Cybercrime Network Demolished in Operation Eastwood – Source: www.infosecurity-magazine.com

An international operation, coordinated by Europol and Eurojust, has cracked down on pro-Russian cybercrime network known as NoName057(16).

Dubbed Operation Eastwood, the action led to the disruption of an attack infrastructure consisting of over 100 computer systems worldwide, while a major part of the group’s central server infrastructure was taken offline.

These actions were conducted between July 14 and 17, 2025.

The results of the operation also included arrests in France and Spain, seven arrest warrants issued, 24 house searches and 13 individuals questioned. Five individuals have been added to the EU’s Most Wanted website.

Two of these persons living in the Russian Federation are accused of being the main instigators responsible for the activities of “NoName057(16)”.

Arrest warrants have been issued for them, and four others, by German authorities.

During the action, Europol set-up a coordination center at its headquarters with representatives from France, Germany, Spain, the Netherlands and Eurojust, and made available a Virtual Command Post to connect the other participating countries with the coordination center.

Eurojust enabled authorities to coordinate the judicial activities and plan their respective measures during the action day. 

NoName057(16)’s Cybercriminal Activities

Those acting for NoName057(16) are mainly Russian-speaking sympathizers who use automated tools to carry out distributed denial-of-service (DDoS) attacks.

Operating without formal leadership or sophisticated technical skills, they are motivated by ideology and rewards, according to Europol.

The group has been linked to numerous DDoS attacks. The group was able to construct its own botnet made up of several hundred servers, enabling it to increase the attack load.

Europol said the group has an estimated 4000 supporters recruited via pro-Russian channels, forums and niche chat groups on social media and messaging apps.

Read more: Why Hacktivists Are Joining the Ransomware Ranks

The group also used these channels to share actions, tutorials and updates. Platforms like DDoSia were used to simplify technical processes and provide guidelines, enabling new recruits to become operational quickly.

Participants in NoName057(16)’s attacks were paid in cryptocurrency and volunteers were subject to game-like notifications for participation like leader boards, regular shout outs and badges.

This gamified manipulation, often targeted at younger offenders, was emotionally reinforced by a narrative of defending Russia or avenging political events, Europol said.

The cybercrime network primarily targeted Ukraine. However, Europol noted they have shifted to also attack countries that support Ukraine in the ongoing conflict against Russia.

In 2023 and 2024, the criminal network took part in attacks against Swedish authorities and bank websites.

Since Europol’s investigations started in November 2023, Germany saw 14 separate waves of attacks targeting more than 250 companies and institutions.

In Switzerland, multiple attacks were carried out in June 2023, during a Ukrainian video-message addressed to the Joint Parliament, and in June 2024, during the Peace Summit for Ukraine at Bürgenstock.

The Dutch authorities also confirmed that an attack linked to this network had been carried out during the NATO summit in the Netherlands held in June 2025. These attacks have all been mitigated without any substantial interruptions.

The July 2025 operation involved law enforcement and judicial authorities from Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands and the United States.