Europol Coordination Global Operations Defeat the Pro-Lucia Cybercrime Network

The collaborative international venture, announced Wednesday, has been hit by the infrastructure of Russian cybercrime networks in connection with a series of service attacks targeting Ukraine and its allies.

The Eastwood codename covers the so-called NONAME057(16) group, identified by Dutch authorities as behind a series of denial-of-service attacks against several municipalities and organizations related to the Netherlands NATO summit last month.

Europol said cybercrime networks are also involved in attacks in Sweden, Germany and Switzerland.

The international operation “has led to disruptions between attacks, consisting of over 100 computer systems around the world, but the majority of the group’s central server infrastructure was carried out offline,” the police agency said.

Law enforcement and judicial authorities from France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Czech Republic, the Netherlands and the United States simultaneously took action against infrastructure in which criminals and infrastructure belong to non-Roussian cybercriminal networks.

Western officials have accused Russia and the proxies of staging dozens of attacks, attempts to sabotage and other incidents across Europe since the Ukrainian invasion, including cyber attacks. The Associated Press tracks them with a detailed map showing the breadth of efforts to sow the divisions in European society and undermine support for Ukraine.

As part of its latest operation, German judicial authorities issued six arrest warrants for Russian suspects, two of whom were accused of being the group’s leading leader, Europol said. Five of them were identified on Europol’s most wanted website in Europe.

One suspect was preliminary arrested in France and another was taken into custody in Spain, Europol said. The Paris Prosecutor’s Office said one person was in detention in France and communications equipment was seized. No claims have been filed yet. In the United States, the Federal Bureau of Investigation was involved in the business.

The Swiss Attorney General’s Office, which is not an EU member state, said in a statement Wednesday that a joint investigation between Europol and Swiss Federal police helped identify three key members of the group.

Swiss prosecutors launched criminal lawsuits over the case in June 2023 and have since identified several other denial-of-service attacks stemming from activist groups. The attack included a video address to the Swiss Parliament by Ukrainian President Voldy Mie Selensky and a popular Eurovision Song Contest held in Basel earlier this year.

Europol said that while members of the cybercrime group initially targeted Ukrainian institutions, “but they have shifted their focus to attacking countries supporting Ukraine in their continued defense against the Russian attack war.”

The nation’s law enforcement agencies involved in the business contacted hundreds of people believed to support the group to inform them of their repression of their actions and their alleged liability.

“Individuals acting for NonMAME057 (16) are Russian-speaking sympathizers who use automated tools to carry out distributed denied denied (DDO) attacks. They operate without formal leadership or sophisticated technical skills, so they are motivated by ideology and rewards.”

The people recruited by the group added that they are paid in cryptocurrency and are motivated to use online gaming dynamics such as leaderboards and badges.

“This gaming manipulation, which often targeted young criminals, was emotionally reinforced by the narrative of defending Russia and revenging political events,” Eporuol said.

©2025 Associated Press. Unauthorized reproduction is prohibited. This material will not be published, broadcast, rewritten or redistributed without permission.