Loading story…
U.S. authorities have indicted Ukrainian national Victoria Eduardovna Dubranova for her alleged involvement in cyberattacks targeting critical infrastructure worldwide, including water systems, food supply chains, election systems, and nuclear facilities. Dubranova, also known as Vika, Tory, and SovaSonya, is accused of supporting two Russian state-backed hacktivist groups: NoName057(16) and CyberArmyofRussia_Reborn (CARR). She was extradited to the United States and has pleaded not guilty to charges in two separate cases, with trials scheduled for 2026. The Justice Department asserts that these attacks were not financially motivated but were designed to disrupt essential services and cause widespread damage.
CARR has claimed responsibility for hacking drinking water systems in multiple U.S. states, resulting in major spills and system failures, as well as attacking a Los Angeles meat processing facility, which led to an ammonia leak and food spoilage. NoName057(16) is known for deploying its custom DDoS tool, DDoSia, to knock government and critical infrastructure websites offline, recruiting global volunteers and offering cryptocurrency rewards. Both groups are believed to have direct ties to Russian state entities, with CARR reportedly founded and directed by the Russian GRU and NoName057(16) partially administered by a Kremlin-established IT organization. The indictments highlight the increasing use of state-backed hacktivist groups to target Western critical infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Alongside the criminal case, U.S. authorities announced financial rewards for information on CARR and NoName057(16) members, referenced sanctions on key operatives, and issued a joint cybersecurity advisory warning critical infrastructure operators about the threat. The advisory highlighted ongoing risks to operational technology and exposed remote access systems.
After being brought to the United States, Dubranova entered a not guilty plea to the charges related to her alleged support for the Russian-aligned hacking groups. Reporting said separate trials were scheduled following the plea.
The U.S. Justice Department unsealed charges against Ukrainian national Victoria Eduardovna Dubranova and confirmed her extradition to the United States for allegedly supporting CARR and NoName057(16). She was accused of conspiracy, damaging protected systems, fraud, and identity theft tied to attacks on critical infrastructure.
In July 2025, law enforcement disrupted more than 100 servers linked to NoName057(16). Authorities also arrested two individuals in France and Spain as part of the operation.
The U.S. Treasury Department sanctioned two leading members of CyberArmyofRussia_Reborn in response to the group's attacks on critical infrastructure. The sanctions were cited by later reporting on the broader U.S. response to the campaign.
CARR carried out intrusions against public water systems and a Los Angeles-area meat processing facility, causing real-world impacts including water disruptions, pump activations, spills, spoiled food, and an ammonia leak. The activity marked an escalation from online disruption to operational technology effects.
CyberArmyofRussia_Reborn (CARR) and NoName057(16) began conducting cyberattacks in 2022 against government and critical infrastructure targets in the U.S. and allied countries. The groups were later described by U.S. authorities as backed, sanctioned, or supported by Russian government entities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcego.theregister.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcecyberscoop.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice announced two indictments against Ukrainian national **Victoria Eduardovna Dubranova**, alleging she supported the pro-Russia hacking groups **CyberArmyofRussia_Reborn (CARR)** and **NoName057(16)** in cyberattacks against critical infrastructure and other targets worldwide. U.S. prosecutors said Dubranova was extradited to the United States and pleaded not guilty in both cases, while the government described CARR as founded, funded, and directed by Russia’s **GRU** and characterized NoName057(16) as a state-sanctioned project linked in part to Russia’s Center for the Study and Network Monitoring of the Youth Environment (**CISM**). According to the indictments, CARR targeted U.S. public water systems, a Los Angeles meat processing facility, election infrastructure, and nuclear regulatory websites, while NoName057(16) used its **DDoSia** platform and a global volunteer network to disrupt government agencies, financial institutions, railways, ports, and other critical infrastructure. The Justice Department said the criminal cases were paired with broader U.S. government action, including State Department reward offers, a joint cybersecurity advisory, and references to earlier **OFAC** sanctions against two alleged CARR members.
Aug 14, 2026
The US Department of Justice announced indictments against Ukrainian national Victoria Eduardovna Dubranova for her involvement in cyberattacks supporting Russian state interests, specifically through the groups CyberArmyofRussia_Reborn (CARR) and NoName057(16). The indictments allege that these groups received financial and logistical support from the Russian government, enabling them to conduct disruptive operations, including the use of proprietary distributed denial-of-service (DDoS) tools. Dubranova, extradited to the US, faces trial for her roles in both groups, which are accused of targeting critical infrastructure worldwide. During the same period, threat intelligence sources reported a significant DDoS campaign attributed to NoName057(16) and their DDoSia project, with a particular focus on German infrastructure. Between December 29, 2025, and January 4, 2026, over 2,600 attacks were recorded, primarily targeting German domains and IP addresses, marking a strategic escalation against one of Ukraine's key European allies. This campaign demonstrates the operational impact of the indicted groups and highlights the ongoing threat posed by Russian state-backed cyber actors to European critical infrastructure.
Jun 29, 2026
An international law enforcement operation disrupted **NoName057(16)**, a pro-Russian hacktivist network accused of launching distributed denial-of-service attacks against Ukraine and countries supporting Kyiv, including EU and NATO members. Europol and Eurojust said **Operation Eastwood** took more than 100 servers offline, dismantled a significant portion of the group’s infrastructure, and led to arrests, arrest warrants, house searches, and interviews across multiple countries with U.S. support. Investigators said the group relied on automated tooling, botnet infrastructure, and the **DDoSia** platform, while recruiting participants through social media, messaging channels, cryptocurrency payments, and gamified incentives such as leaderboards and badges. U.S. authorities later tied the disruption to broader action against Russian state-backed cyber actors, unsealing indictments against **Victoria Eduardovna Dubranova** for allegedly supporting both **NoName057(16)** and **CyberArmyofRussia_Reborn (CARR)**. The Justice Department said the groups carried out hundreds of attacks worldwide, including activity targeting U.S. critical infrastructure such as public water systems and election infrastructure, and described NoName as a state-sanctioned project linked to Russian organization **CISM**. A related CISA advisory warned that pro-Russia hacktivists were conducting attacks against critical infrastructure, reinforcing concerns that ideologically branded DDoS campaigns are being used to advance Russian geopolitical objectives.
Aug 14, 2026