Pro-Russian Hackers Target Italian Officials and Investigators on Darkweb
NoName057(16) group offers bounties for private data of top Italian security officials.
1Targeting Key Security Officials
The pro-Russian hacker group NoName057(16) has published private information belonging to high-ranking Italian officials. Targets include Foreign Minister Antonio Tajani, Rome Prosecutor Francesco Lo Voi, and Postal Police chief Ivano Gabrielli. These individuals are currently leading investigations into the collective's activities, marking a direct escalation in the ongoing cyber conflict.
2The Darkweb 'Tribunal' Platform
The hackers utilize a darkweb site titled 'Tribunal' to host dossiers on eighteen European targets. The site, accessible only via the Tor network, contains email addresses, phone numbers, and Telegram contacts. The group explicitly offers financial rewards to users who provide additional private information on these specific individuals, facilitating further harassment.
3Retaliation for Operation Eastwood
This campaign appears to be a direct response to Operation Eastwood, an international crackdown coordinated by Europol and Eurojust between July 14 and 17, 2025. Italian authorities, specifically the Rome Prosecutor’s Office and the Postal Police, played a central role in identifying members of the group, prompting this retaliatory data exposure.
4Broadening the Scope of Targets
The list extends beyond Italian officials to include international figures such as Eurojust President Michael Schmid and Europol’s cybercrime director Edvardas Šileris. Additionally, three German investigative journalists are named in the dossiers. This expansion indicates a strategic attempt to intimidate those involved in judicial, law enforcement, and media oversight of cybercrime.
5Diplomatic Tensions and DDoS Attacks
Foreign Minister Antonio Tajani has faced repeated hostility from Russian officials, including spokesperson Maria Zakharova, following his warnings about election interference. On October 8, the Italian Ministry of Foreign Affairs website suffered a massive DDoS attack. This digital assault coincided with the public exposure of Tajani’s personal contact details on the darkweb.
6Hybrid Warfare Tactics Explained
NoName057(16) is widely linked to the GRU, Russia’s military intelligence agency. Their tactics combine technical DDoS attacks, which overwhelm servers with traffic, with psychological intimidation through data leaks. This hybrid warfare strategy aims to destabilize European institutions by targeting the personal lives of those responsible for national and regional security.
7Escalating European Security Risks
The current situation is part of a broader pattern of hybrid threats across Europe, including recent false bomb alarms on aircraft and cyberattacks on retail infrastructure. While the direct coordination of these events by the Kremlin remains a hypothesis, the systematic exposure of private data represents a tangible reality for European officials.
8Investigative Response and Implications
The Rome Prosecutor’s Office has officially opened an investigation following the filing of a criminal report. As authorities work to mitigate the impact of these leaks, the incident highlights the vulnerability of public servants to digital retaliation. The focus remains on protecting the individuals targeted while countering the group's ongoing cyber operations.