Between 14 and 17 July 2025, authorities from thirteen countries, including Italy, took part in an international operation coordinated by Europol and Eurojust, called Operation ‘Eastwood’, against the pro-Russian collective NoName057(16), responsible for numerous cyber attacks in support of the Russian war in Ukraine.

The operation also saw the technical involvement of private actors such as ShadowServer and abuse.ch, and the support of nine other states, as well as the assistance of ENISA.

Infrastructure disrupted and arrests made

In the course of operations, more than 100 servers were disrupted and a large part of the group’s central infrastructure was deactivated. The authorities conducted 24 searches in several countries and issued 7 arrest warrants, six of which were issued by Germany against Russian citizens.

Two arrests were made in France and Spain. In addition, more than a thousand affiliates of the network were identified and notified via messaging apps. Five individuals linked to the group are now on the EU’s most wanted list.

Italy among the affected countries

Between 26 and 27 December 2024, the collective had struck Italy with a series of DDoS attacks targeting institutional sites. The portals of the Ministry of Infrastructure, the Ministry of Economic Development, the Guardia di Finanza, the Armed Forces, the Carabinieri, the Navy, and the Ministry of Foreign Affairs were temporarily inaccessible.

The sites of Linate and Malpensa airports were also affected, but without any impact on flight operations. The claims came via Telegram with the message: ‘Italian Russophobes get a well-deserved IT response’.

DDoS attacks

DDoS (Distributed Denial of Service) attacks consist of overloading a site or online service with a huge amount of artificially generated traffic, using a network of compromised devices(botnet), with the aim of blocking its operation and making it inaccessible to legitimate users.

New escalation in February 2025

The collective struck back in February 2025, launching attacks against financial institutions, such as Mediobanca and Nexi, and arms industries, such as Franchi, Danieli, Fiocchi munizioni, Benelli, plus the Italian Automobile Club and numerous institutional portals, local transport companies, ports and airports.

The offensive appears to have been a direct response to statements by President of the Republic Sergio Mattarella, who compared Russian aggression against Ukraine to the expansionism of the Third Reich.

European Coordination and Shared Reaction

The neutralisation of the NoName057(16) collective demonstrates how the Russian and pro-Russian cyber threat is active, persistent and strategically oriented to target institutions and infrastructures in countries supporting Ukraine. In this context, a coordinated European response is crucial, strengthening the resilience of Member States against disinformation campaigns and digital attacks. The role of Europol and Eurojust remains crucial in coordinating synergetic actions between police forces, judicial authorities and private partners at transnational level, with the aim of preventing, containing and repressing all forms of cyber threats, in a context increasingly marked by the dynamics of hybrid warfare.