Loading story…
The U.S. Department of Justice announced two indictments against Ukrainian national Victoria Eduardovna Dubranova, alleging she supported the pro-Russia hacking groups CyberArmyofRussia_Reborn (CARR) and NoName057(16) in cyberattacks against critical infrastructure and other targets worldwide. U.S. prosecutors said Dubranova was extradited to the United States and pleaded not guilty in both cases, while the government described CARR as founded, funded, and directed by Russia’s GRU and characterized NoName057(16) as a state-sanctioned project linked in part to Russia’s Center for the Study and Network Monitoring of the Youth Environment (CISM).
According to the indictments, CARR targeted U.S. public water systems, a Los Angeles meat processing facility, election infrastructure, and nuclear regulatory websites, while NoName057(16) used its DDoSia platform and a global volunteer network to disrupt government agencies, financial institutions, railways, ports, and other critical infrastructure. The Justice Department said the criminal cases were paired with broader U.S. government action, including State Department reward offers, a joint cybersecurity advisory, and references to earlier OFAC sanctions against two alleged CARR members.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice announced two indictments against Victoria Eduardovna Dubranova for allegedly supporting the pro-Russia hacking groups CyberArmyofRussia_Reborn and NoName057(16). The announcement also described the groups as Russian state-backed operations targeting critical infrastructure and other victims worldwide.
In November 2024, CyberArmyofRussia_Reborn allegedly attacked a meat processing facility in Los Angeles. The attack reportedly spoiled thousands of pounds of meat and triggered an ammonia leak.
The Center for the Study and Network Monitoring of the Youth Environment (CISM), later alleged to have helped administer NoName057(16), was established by order of the President of Russia in October 2018.
After her extradition, Dubranova was arraigned on a second indictment related to NoName057(16). She pleaded not guilty in both criminal cases.
Victoria Eduardovna Dubranova was extradited to the United States earlier in 2026 on an indictment related to CyberArmyofRussia_Reborn. The announcement says she later faced a second case tied to NoName057(16).
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourceepa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities have indicted Ukrainian national Victoria Eduardovna Dubranova for her alleged involvement in cyberattacks targeting critical infrastructure worldwide, including water systems, food supply chains, election systems, and nuclear facilities. Dubranova, also known as Vika, Tory, and SovaSonya, is accused of supporting two Russian state-backed hacktivist groups: NoName057(16) and CyberArmyofRussia_Reborn (CARR). She was extradited to the United States and has pleaded not guilty to charges in two separate cases, with trials scheduled for 2026. The Justice Department asserts that these attacks were not financially motivated but were designed to disrupt essential services and cause widespread damage. CARR has claimed responsibility for hacking drinking water systems in multiple U.S. states, resulting in major spills and system failures, as well as attacking a Los Angeles meat processing facility, which led to an ammonia leak and food spoilage. NoName057(16) is known for deploying its custom DDoS tool, DDoSia, to knock government and critical infrastructure websites offline, recruiting global volunteers and offering cryptocurrency rewards. Both groups are believed to have direct ties to Russian state entities, with CARR reportedly founded and directed by the Russian GRU and NoName057(16) partially administered by a Kremlin-established IT organization. The indictments highlight the increasing use of state-backed hacktivist groups to target Western critical infrastructure.
Jun 29, 2026
The US Department of Justice announced indictments against Ukrainian national Victoria Eduardovna Dubranova for her involvement in cyberattacks supporting Russian state interests, specifically through the groups CyberArmyofRussia_Reborn (CARR) and NoName057(16). The indictments allege that these groups received financial and logistical support from the Russian government, enabling them to conduct disruptive operations, including the use of proprietary distributed denial-of-service (DDoS) tools. Dubranova, extradited to the US, faces trial for her roles in both groups, which are accused of targeting critical infrastructure worldwide. During the same period, threat intelligence sources reported a significant DDoS campaign attributed to NoName057(16) and their DDoSia project, with a particular focus on German infrastructure. Between December 29, 2025, and January 4, 2026, over 2,600 attacks were recorded, primarily targeting German domains and IP addresses, marking a strategic escalation against one of Ukraine's key European allies. This campaign demonstrates the operational impact of the indicted groups and highlights the ongoing threat posed by Russian state-backed cyber actors to European critical infrastructure.
Jun 29, 2026
An international law enforcement operation disrupted **NoName057(16)**, a pro-Russian hacktivist network accused of launching distributed denial-of-service attacks against Ukraine and countries supporting Kyiv, including EU and NATO members. Europol and Eurojust said **Operation Eastwood** took more than 100 servers offline, dismantled a significant portion of the group’s infrastructure, and led to arrests, arrest warrants, house searches, and interviews across multiple countries with U.S. support. Investigators said the group relied on automated tooling, botnet infrastructure, and the **DDoSia** platform, while recruiting participants through social media, messaging channels, cryptocurrency payments, and gamified incentives such as leaderboards and badges. U.S. authorities later tied the disruption to broader action against Russian state-backed cyber actors, unsealing indictments against **Victoria Eduardovna Dubranova** for allegedly supporting both **NoName057(16)** and **CyberArmyofRussia_Reborn (CARR)**. The Justice Department said the groups carried out hundreds of attacks worldwide, including activity targeting U.S. critical infrastructure such as public water systems and election infrastructure, and described NoName as a state-sanctioned project linked to Russian organization **CISM**. A related CISA advisory warned that pro-Russia hacktivists were conducting attacks against critical infrastructure, reinforcing concerns that ideologically branded DDoS campaigns are being used to advance Russian geopolitical objectives.
Aug 14, 2026