Spain arrests three in pro-Russian DDoS crew takedown

Officials in Spain arrested three people as part of a takedown of a pro-Russia hacktivist group.

The nation’s Ministry of Interior announced that three residents from different parts of the country were taken into custody for their alleged involvement in hacktivist crew NoName057(16).

The three were not named and charges were not announced. The ministry noted that police raided the homes and retained possible evidence from all three suspects.

Investigators said that aside from having an incredibly boring moniker, NoName057(16) functions as a hacktivist crew primarily carrying out politically motivated DDoS attacks on government agencies and vital services.

Formed in the wake of Russia’s invasion of the Ukraine, NoName057(16) targets NATO countries that have backed Ukraine in its efforts to stop Putin’s attempt to invade and establish a vassal state.

“In their own founding manifesto, this group acknowledges that they will respond proportionately in response to the hostile and openly anti-Russian actions of Western Russophobes,” the ministry said.

Officials noted that unlike other hacktivist groups that usually rely on off-the-shelf tools to perform their attacks, NoName057(16) uses its own purpose-built DDoS software. Dubbed “DDoSia,” the traffic cannon is particularly effective at flooding sites and taking services offline.

No information was given on possible court dates.

The arrest of the hacktivists comes as countries around the world are seeing an increase in DDoS activity largely driven by global events such as the war in Ukraine. Cloud backbone provider Cloudflare said that its own anti-DDoS has logged a significant year-on-year increase.

According to figures shared with CyberRisk Alliance, Cloudflare’s systems have stopped some 8.5 million attacks in the first two quarters of 2024. That is more than 60% of what the company caught in the entire 2023 calendar year.

A spokesperson noted that in addition the ongoing war in Ukraine, the trial of WikiLeaks founder Julian Assange brought a spike in DDoS activity as the tiny nation of Northern Marianas Islands, which hosted the trial, was flooded by supporters of the leaks dealer.