EU exposes Russian hacker group tied to Kremlin-backed IT firm

According to the investigation, the hackers openly supported Russia’s aggression against Ukraine and launched cyberattacks during major political events, including elections for the European Parliament, NATO summits, and Ukraine-related public events.

In Germany, the hackers carried out 14 attacks that targeted nearly 230 organizations and companies. In Switzerland, cyberattacks coincided with Ukrainian President Volodymyr Zelenskyy’s address to the European Parliament in June 2023 and the Ukraine Peace Summit in June 2024.

Europol and Eurojust officials said that NoName057(16) used a custom botnet program known to conduct the attacks. The malware operated through hundreds of servers and enlisted as many as 4,000 unwitting users via messaging apps.

EU authorities have issued seven arrest warrants and released details on five suspects—all of whom are Russian citizens, according to independent Russian outlet Agentstvo.

Two suspects, Mikhail Burlakov and Maxim Lupin, lead an IT firm called the Center for Youth Research and Network Monitoring. The firm was founded at the direction of Russian dictator Vladimir Putin, and preliminary reports indicate that the Kremlin allocated at least RUB2 billion ($26 million) to the company. Notably, Burlakov and Lupin attended Putin’s address to the Russian Federal Assembly in 2023.

Europol described Burlakov as “one of the key members” of NoName057(16). Operating under the alias “Darkklogo,” he oversaw the group, approved the development of malicious software, and arranged payments for leasing server infrastructure. Burlakov is a veteran programmer with a technical sciences degree and teaches cybersecurity at Samara University.

Europol suspects Lupin of managing an illegal online marketplace. Since the mid-2010s, he worked as a cybersecurity expert for the pro-Kremlin veterans’ organization Combat Brotherhood and as a project manager at ZephyrLab, which builds websites for ministries in the Russian government.

Another key figure is 21-year-old Olga Yevstratova, who, according to law enforcement, optimized programs for distributed denial-of-service (DDoS) attacks under the alias “olechochek.”

Europol is also seeking 45-year-old Andrey Abrosimov and 48-year-old Andrey Muravyov. Abrosimov, born in Russia’s Arkhangelsk Oblast, previously worked as a car mechanic and installed industrial thermal insulation. Muravyov, an artist from Moscow’s Chertanovo district and an outspoken supporter of Russia’s war against Ukraine, said he is under investigation for designing the logo and stickers for the Telegram channel administered by NoName057(16). The channel’s description states that it is run by the hacker group “whose purpose is to fight the West.”