iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Operation Eastwood was a coordinated international law-enforcement action against NoName057(16), a pro-Russian network associated with distributed denial-of-service (DDoS) attacks. Its action day was 15 July 2025. Authorities reported disrupting attack infrastructure, issuing arrest warrants, conducting searches and contacting alleged supporters—but those measures do not establish that the network was permanently dismantled. The sources cited here do not establish its operational status as of 8 October 2026.
What is NoName057(16)?
Europol characterized NoName057(16) as an ideological criminal network that professed support for the Russian Federation. National investigations linked it to DDoS attacks in the context of Russia’s war against Ukraine. Czech Police said participants used software called DDoSia and recruited supporters while building a botnet from servers around the world.
A DDoS attack attempts to make a website or online service unavailable by overwhelming it with traffic. As Eurojust explained on 16 July 2025, the traffic overloads the service’s capacity. That definition describes the intended disruption; it does not mean every reported or attempted attack caused an outage.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What was Operation Eastwood?
Europol and Eurojust coordinated the joint operation, which ran from 14 to 17 July 2025, with the action day on 15 July. Authorities in participating countries acted against people and infrastructure associated with the network. Europol’s account described disruption of attack infrastructure consisting of more than 100 systems. Europol’s release and the national summaries describe results at different levels of scope, so their figures should be attributed rather than treated as one identical tally.
#1 Best Overall
What authorities reported
- Arrest warrants: Eurojust said seven warrants were issued, including warrants for suspected main instigators living in Russia.
- Arrests: The Czech Police summary reported two arrests: one preliminary arrest in France and one in Spain.
- Searches: Czech Police reported 24 residential searches. Eurojust listed searches in Germany, Latvia, Spain, Italy, Czechia, Poland and France.
- Infrastructure: Czech Police said more than 100 servers were taken offline and a substantial part of the network’s central infrastructure was disconnected. Eurojust said the action day shut down a botnet using hundreds of computer systems worldwide.
- Contact with alleged supporters: Czech Police reported contacting more than 1,000 supporters. Eurojust said authorities informed more than 1,100 supporters and 17 administrators about the measures and potential criminal liability.
The distinction between arrests and warrants matters: the two arrests in the Czech Police account are not seven additional arrests. The seven figure refers to warrants reported by Eurojust.
Did police take down the NoName057(16) DDoS network?
Authorities disrupted infrastructure and disconnected a substantial part of the network’s central systems, but the available official accounts do not establish a permanent dismantling or confirm the group’s status as of 8 October 2026. An operation can make a botnet and its supporting infrastructure harder to use without proving that every participant, system or capability has disappeared.
What targets did the group claim, and what impact was confirmed?
ENISA’s October 2025 Threat Landscape says NoName057(16)’s claims particularly concerned Italy, France, Poland, Lithuania and Germany. The report describes activity directed at public administration—including ministries, parliamentary sites and municipalities—finance, such as banks and payment service providers, and transport, including air and rail websites. It also notes occasional targeting of telecoms and hosting services. ENISA assessed the activity as driven by geopolitical developments and support for Ukraine. These reported claims and target categories are not proof that each attack succeeded.
Recommended Free Tools
ENISA found that, although the group was among the most prolific by activity volume in its analysis, its activity led to almost no confirmed outages. The agency said this finding was consistent with an information-operation aspect to the activity. In other words, claimed attacks, attempted attacks and verified service disruption are different measures; high volume alone does not demonstrate widespread service outages.
Rank #3
How many people were arrested?
The Czech Police summary reported two arrests—one preliminary arrest in France and one in Spain. Eurojust separately reported seven arrest warrants, including warrants for suspected main instigators living in Russia. A warrant is not the same as an arrest, and the releases do not present those figures as interchangeable.
Quick Recap
Best Value
Sources
- Europol: International operation targets pro-Russian hacker network
- Eurojust: International operation disrupts pro-Russian cybercriminal network
- Police of the Czech Republic: Operation Eastwood
- ENISA: ENISA Threat Landscape 2025
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
