Putin reeling after NATO states deliver deadly blow to Russian sabotage group

 

Pro-Russian Hacker Group Dismantled After Targeting NATO Infrastructure Across Europe

A major international law enforcement operation has disrupted the activities of NoName057(16), a pro-Russian hacker collective responsible for a series of cyberattacks across Europe. Western intelligence and security agencies coordinated the takedown following months of growing concern over politically motivated attacks on critical infrastructure.

Originally focused on cyber operations against Ukraine, the group gradually expanded its targets to include NATO member states and key allies of Kyiv. Over the past two years, the group has launched attacks on national infrastructure, including banking systems, public transportation, and electricity grids. Notably, Germany has suffered at least 14 waves of cyberattacks since November 2023, impacting more than 250 institutions and businesses.

Most recently, Dutch authorities confirmed that NoName057(16) was behind a cyberattack timed with the latest NATO summit held in the Netherlands—an alarming sign of the group’s reach and boldness.

Between July 14 and 17, authorities from multiple countries, including the U.S., Germany, France, Sweden, Poland, and the Netherlands, participated in Operation Eastwood, a joint initiative aimed at dismantling the group's operational capabilities. Investigators succeeded in taking down a major part of the group’s server infrastructure, spanning over 100 computer systems globally.

As part of the operation, seven arrest warrants were issued—six of them for Russian nationals. Authorities described the group as an ideologically driven cybercrime network that supports the Kremlin’s objectives in Ukraine.

The group, which is believed to have around 4,000 supporters, mainly carried out distributed denial-of-service (DDoS) attacks and operated its own custom-built botnet using hundreds of hijacked servers. Participants were reportedly paid in cryptocurrency, making it easier to recruit and motivate actors who could operate in the shadows.

Europol has flagged the group as part of a broader trend where state-sponsored cyber operations are increasingly intertwined with organized criminal networks. In a report published earlier this year, the agency warned that these so-called “hybrid threats” are being used to destabilize democratic institutions, disrupt infrastructure, and undermine social cohesion within the EU.

Magnus Brunner, the EU Commissioner for Internal Affairs and Migration, highlighted the gravity of this shift during the report’s launch:

“We are seeing criminal groups work on behalf of foreign powers. That’s something new—and very dangerous.”

He added: “Some threats enter our union in less than a second as encrypted messages; others arrive slowly, such as groups of migrants reportedly facilitated by Russian networks. These tactics are part of a broader strategy to sow division and instability within Europe.”

With cyberattacks increasingly used as tools of geopolitical influence and disruption, EU and NATO officials say stronger collective defense measures will be essential in protecting institutions and critical infrastructure from future incidents.