NoName pro-Russian hackers arrested in Spain, group vows retaliation
Pro-Russian hacktivist group NoName057(16) unleashes a wave of attacks against Spain after three of its members are arrested by Spanish authorities over the weekend.
Image by Mehaniq | Shutterstock
Pro-Russian hacktivist group NoName057(16) unleashes a wave of attacks against Spain after three of its members are arrested by Spanish authorities over the weekend.
Spanish police announced the arrests on Saturday, accusing the three suspects of carrying out alleged cyberattacks against Spain and fellow NATO allies who support Ukraine for terrorist purposes.
The suspects were “searched and computer equipment was seized,” according to police reports.
NoName is well-known for its distributed denial-of-service (DDoS) attacks commonly targeting the websites of Western governments and critical infrastructure entities located in the US, the EU, Israel, and Ukraine.
"These computer attacks have been organized by the hacktivist group NoName057(16), after the invasion of Ukraine by Russia and [has been] one of the most active," the Civil Guard of the Spanish Interior Ministry said in a statement.
Spanish authorities released a video of the raid on social media platform X which showed the home of one of the suspects with a Soviet-era hammer and sickle flag mounted on their wall.
Spanish police have arrested three people suspected of hacking attacks on behalf of Russian security services
undefined NEXTA (@nexta_tv) July 20, 2024
The detainees are believed to be part of a group of pro-Russian hackers known as NoName057. pic.twitter.com/kLCC96Z4Iw
"In their own founding manifesto, this group acknowledges that they 'will respond proportionately in response to the hostile and openly anti-Russian actions of Western Russophobes,'" the police said.
NoName vows revenge
Almost immediately after the arrests, the hacktivist gang wasted no time posting a revenge manifesto on its Telegram channel and retaliating against the EU nation with a wave of DDoS attacks against Spanish critical infrastructure.
“We declare a vendetta against the Spanish authorities, who lawlessly detained our comrades!” the group posted Monday, labeling the operation a “witch hunt.”
“We call on all pro-Russian hacker groups to join us in unleashing all their power on the Internet infrastructure of Spain as a sign of support for the detainees,” it said, adding “Glory to Russia!”
The staunch Russian supporters then proceeded to claim attacks against Spain’s infrastructure including on the city of Valencia, and the major ports of Cartagena, Vigo, Castellón, Palma de Mallorca, and Huelva.
The group also happened to attack more than a dozen sites in the Czech Republic on Monday.
NoName followed up in a separate longer post boasting how US and EU authorities were “afraid of us like hell” and how, for years, the group was able to cause “enormous damage to all sponsors of the Zelensky criminal regime around the clock.”
“Our Cyberarmy is growing by the hour, day by day,” the cyber terrorists said, adding that Europeans are “frankly outraged” by their governments giving “huge amounts of money to sponsor Zelensky's terrorists, to the detriment of their economy."
The post was accompanied by a picture of its signature Russian bear flipping off Spain with its middle finger.
The three arrests took place in Manacor, the second largest town on the Balearic Island of Mallorca, and in the municipalities of Huelva and Seville, in southwestern Spain, police said.
NoName attacks keep coming
NoName first declared itself in March 2022 as a political response to the West and its aversion to the Russian invasion of Ukraine.
According to threat researchers at Radware, NoName057(16) operates using Telegram channels where they claim responsibility for their attacks, mock targets, make threats, and share educational content.
DDoS attacks work by directing high volumes of internet traffic towards targeted servers, flooding the sites and knocking them offline.
Although DDoS attacks are often seen as more of a nuisance than causing permanent or lasting disruptions, to put the group's efforts in perspective, a Radware research report found that in the first half of 2023, NoName carried out 1174 attacks in 32 Western nations, in just 176 days.
NoName hacking campaigns in 2023 successfully targeted NATO, Italy’s banking system, several of Europe’s largest ports, and Ukraine’s financial sector.
Other critical infrastructure attacks claimed by NoName last year include those against Poland, Denmark, Lithuania, and the French parliament, as well as nearly a dozen attacks on Switzerland’s financial and aviation sectors.