Seven arrest warrants issued in global swoop on suspected Russia-linked hackers

By Giulia Segreti and Thomas Escritt

ROME/BERLIN (Reuters) -Germany and Spain issued arrest warrants for seven suspected members of a pro-Russian hacking group accused of carrying out cyber attacks against critical infrastructure, arms makers, power companies and public authorities.

The warrants resulted from an international operation involving law enforcement and judicial authorities including the U.S., France, Sweden, Italy, the Netherlands and Switzerland, German prosecutors and pan-European police agency Europol said in separate statements on Wednesday.

German prosecutors said they had helped to coordinate the swoop on Tuesday in multiple countries in which 24 premises linked to the hacking group - which calls itself NoName057(16) - were searched, including one in Berlin and two in Bavaria in southeastern Germany.

Germany issued six arrest warrants, five of them public, and Spain issued another.

The NoName group had used the Telegram messaging app to enlist over 4,000 volunteers who made their systems available for swamping critical institutions' servers with so-called distributed denial of service attacks, the German prosecutors said.

The premises searched included those linked to volunteers in the Telegram group, they said.

In the past years the NoName collective, known for promoting Russian interests, has allegedly carried out successful cyberattacks in Ukraine and on government, infrastructure, banking, health services and telecom websites in European countries that have backed it against Russia. 

European authorities are increasingly concerned at the scale of the hybrid threats they say emanate from Russia, which is in the third year of its invasion of Western ally Ukraine.

Those threats, which have included killings and alleged bomb plots against institutions and cargo aircraft, have largely been attributed to state actors. Russia has denied the accusation.

In this case, prosecutors did not specifically link the suspects to the state.

MEDIA ATTENTION

"The aim of the attacks on German targets was to garner media attention and thereby influence political and social decision-making in Germany," prosecutors said in the statement.

The prosecutors and Europol published names and pictures of five of the people they were seeking, all of them Russian citizens and presumed to be residing in Russia. A further German arrest warrant remains sealed.

Prosecutors identified one of the Russian citizens as one of two leading figures in the group it was seeking.

Europol said volunteers were recruited through Russian channels, chat groups, social media and messaging apps and that they often invited contacts from gaming and hacking forums.

Italian authorities added in a separate statement that sympathisers were given lists of Western targets to hit and provided with the software needed to participate.

They added that the organisation - which paid with cryptocurrencies - had a "central line of command and control in the Russian Federation".

The group also ran its own botnet - a network of private computers infected with malware and controlled by hackers - of several hundred servers to amplify the impact, they said.

Authorities in the Czech Republic, Finland, Lithuania and Poland contributed to the investigation, said Europol, which helped to coordinate it.

(Reporting by Thomas Escritt in Berlin and Giulia Segreti in Rome; Editing by Miranda Murray and Emelia Sithole-Matarise)