NoName057 Expanded Pro-Russian DDoS Campaigns Across Europe

Pro-Russian hacktivist group NoName057(16) intensified distributed denial-of-service attacks against government and private-sector targets across Europe, including Dutch public services disrupted around the NATO Summit in The Hague. Reported incidents in the Netherlands included attacks on municipal and provincial websites and an earlier strike on Logius that temporarily affected DigiD and access to services used by the Belastingdienst, UWV, DUO, and hospital portals. The group has also targeted organizations in Ukraine, Israel, and other European countries, often timing attacks to politically significant events and focusing on sectors such as government, transportation, banking, defense, media, and energy.

The group’s operations relied on Telegram for propaganda, recruitment, and coordination, while the DDoSia platform distributed encrypted attack parameters to volunteers who could be rewarded with cryptocurrency. Reporting also linked the ecosystem to malware including Bobik and RedLine Stealer, which were used to support involuntary participation in attacks. An international law-enforcement action, Operation Eastwood, led by Europol and Eurojust, disrupted more than 100 servers tied to the network and resulted in arrests, warrants, and notifications to participants, dealing a significant blow to the group’s infrastructure even as its public claims were described as overstating real-world impact.