Loading story…
The US Department of Justice announced indictments against Ukrainian national Victoria Eduardovna Dubranova for her involvement in cyberattacks supporting Russian state interests, specifically through the groups CyberArmyofRussia_Reborn (CARR) and NoName057(16). The indictments allege that these groups received financial and logistical support from the Russian government, enabling them to conduct disruptive operations, including the use of proprietary distributed denial-of-service (DDoS) tools. Dubranova, extradited to the US, faces trial for her roles in both groups, which are accused of targeting critical infrastructure worldwide.
During the same period, threat intelligence sources reported a significant DDoS campaign attributed to NoName057(16) and their DDoSia project, with a particular focus on German infrastructure. Between December 29, 2025, and January 4, 2026, over 2,600 attacks were recorded, primarily targeting German domains and IP addresses, marking a strategic escalation against one of Ukraine's key European allies. This campaign demonstrates the operational impact of the indicted groups and highlights the ongoing threat posed by Russian state-backed cyber actors to European critical infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-07, reporting described how NoName057(16) uses the custom DDoSia tool to coordinate volunteer-driven, politically motivated DDoS attacks through controlled command-and-control infrastructure, propaganda, and cryptocurrency incentives. The report also noted the tool's evolution into a modular, multi-platform capability with encrypted C2, traffic randomization, and realistic client signatures.
By the time of the Justice Department announcement, Victoria Eduardovna Dubranova had been extradited to the United States and had entered a not-guilty plea in connection with the two cases. She was reported to be facing trials scheduled for 2026.
On 2026-01-05, the U.S. Justice Department announced indictments against Ukrainian national Victoria Eduardovna Dubranova for alleged involvement in cyberattacks supporting CyberArmyofRussia_Reborn and NoName057(16). The announcement said both groups were backed by the Russian government and GRU and had conducted hundreds of attacks against critical infrastructure, including U.S. utilities, election systems, and financial institutions.
Between 2025-12-29 and 2026-01-04, the pro-Russian threat actor NoName057(16) and its DDoSia project carried out a large DDoS campaign primarily targeting German infrastructure. SOCRadar recorded 2,637 attack entries affecting 115 unique domains and 97 unique IP addresses, with nearly 88% of attacks directed at Germany.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourceflashpoint.io
Open sourcesocradar.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice announced two indictments against Ukrainian national **Victoria Eduardovna Dubranova**, alleging she supported the pro-Russia hacking groups **CyberArmyofRussia_Reborn (CARR)** and **NoName057(16)** in cyberattacks against critical infrastructure and other targets worldwide. U.S. prosecutors said Dubranova was extradited to the United States and pleaded not guilty in both cases, while the government described CARR as founded, funded, and directed by Russia’s **GRU** and characterized NoName057(16) as a state-sanctioned project linked in part to Russia’s Center for the Study and Network Monitoring of the Youth Environment (**CISM**). According to the indictments, CARR targeted U.S. public water systems, a Los Angeles meat processing facility, election infrastructure, and nuclear regulatory websites, while NoName057(16) used its **DDoSia** platform and a global volunteer network to disrupt government agencies, financial institutions, railways, ports, and other critical infrastructure. The Justice Department said the criminal cases were paired with broader U.S. government action, including State Department reward offers, a joint cybersecurity advisory, and references to earlier **OFAC** sanctions against two alleged CARR members.
Aug 14, 2026
U.S. authorities have indicted Ukrainian national Victoria Eduardovna Dubranova for her alleged involvement in cyberattacks targeting critical infrastructure worldwide, including water systems, food supply chains, election systems, and nuclear facilities. Dubranova, also known as Vika, Tory, and SovaSonya, is accused of supporting two Russian state-backed hacktivist groups: NoName057(16) and CyberArmyofRussia_Reborn (CARR). She was extradited to the United States and has pleaded not guilty to charges in two separate cases, with trials scheduled for 2026. The Justice Department asserts that these attacks were not financially motivated but were designed to disrupt essential services and cause widespread damage. CARR has claimed responsibility for hacking drinking water systems in multiple U.S. states, resulting in major spills and system failures, as well as attacking a Los Angeles meat processing facility, which led to an ammonia leak and food spoilage. NoName057(16) is known for deploying its custom DDoS tool, DDoSia, to knock government and critical infrastructure websites offline, recruiting global volunteers and offering cryptocurrency rewards. Both groups are believed to have direct ties to Russian state entities, with CARR reportedly founded and directed by the Russian GRU and NoName057(16) partially administered by a Kremlin-established IT organization. The indictments highlight the increasing use of state-backed hacktivist groups to target Western critical infrastructure.
Jun 29, 2026
An international law enforcement operation disrupted **NoName057(16)**, a pro-Russian hacktivist network accused of launching distributed denial-of-service attacks against Ukraine and countries supporting Kyiv, including EU and NATO members. Europol and Eurojust said **Operation Eastwood** took more than 100 servers offline, dismantled a significant portion of the group’s infrastructure, and led to arrests, arrest warrants, house searches, and interviews across multiple countries with U.S. support. Investigators said the group relied on automated tooling, botnet infrastructure, and the **DDoSia** platform, while recruiting participants through social media, messaging channels, cryptocurrency payments, and gamified incentives such as leaderboards and badges. U.S. authorities later tied the disruption to broader action against Russian state-backed cyber actors, unsealing indictments against **Victoria Eduardovna Dubranova** for allegedly supporting both **NoName057(16)** and **CyberArmyofRussia_Reborn (CARR)**. The Justice Department said the groups carried out hundreds of attacks worldwide, including activity targeting U.S. critical infrastructure such as public water systems and election infrastructure, and described NoName as a state-sanctioned project linked to Russian organization **CISM**. A related CISA advisory warned that pro-Russia hacktivists were conducting attacks against critical infrastructure, reinforcing concerns that ideologically branded DDoS campaigns are being used to advance Russian geopolitical objectives.
Aug 14, 2026