Spain Under Attack by Wave of Cyberattacks from NoName Russian Hackers

The pro-Russian cybercriminal group ‘NoName057(16)’ began operating at the beginning of the Russian invasion of Ukraine and has since gained notoriety as it has carried out a multitude of cyber-attacks against countries supporting Ukraine in the conflict, as well as against the Ukrainian nation itself.

In recent months it has targeted Danish, German, Italian, Romanian, Norwegian, Polish, Lithuanian, Swiss, Dutch institutions and companies or against the parliaments of France and Bulgaria, the latter less than a week ago. On June 16 NoName057 also included Spain among its targets, hacking some of its ports –along with those of Italy, Germany and Bulgaria–, and since then it has launched a wave of DDoS (distributed denial of service) attacks, its specialty, against our country that even affect the Royal House.

The gang has claimed these offensives through its Telegram channel, where this past Wednesday, July 19, it announced that it had managed to block the official websites of the Royal House, Moncloa, the Ministries of Justice and Territorial Policy, the Constitutional Court, the Mint and the consulting and engineering company Isdefe.

In their messages, the hackers also justified this series of cyberattacks by recalling “the last 4 Leopard tanks” that Spain sent to Ukraine and alluding directly to Pedro Sánchez, who, as they point out, “promised to support Ukraine for as long as necessary” and “announced the allocation of an ‘aid’ package to Kiev in the amount of 55 million euros.”

NoName continues to attack Spain with offensives against financial and transport entities.

The pro-Russian gang continued its crusade against Spain yesterday, committing new DDoS cyberattacks that were focused on the financial sector. As reported in his Telegram account, this time his victims were ABANCA, Grupo Caja Rural, Banco Cooperativo Español and Bankinter, whose web pages were rendered inoperative. In the case of Bankinter, the hackers also disabled their application and bragged about the entity by sharing the following text:

“We wonder how many clients and money the Spanish bank Bankinter has lost today as a result of our cyberattack, for which we have blocked their website and disabled their application. We think it’s crazy! We have knocked out their infrastructure for a whole working day. We read the ridiculous excuses of the social media managers of this stupid bank and we laughed our heads off.”

NoName057(16) has reappeared this Friday on his Telegram account with a message indicating that they are continuing their “trip through Spain” and that they have attacked the websites of state ports and port authorities. And later, more offensives have been attributed that are focused on the transport sector and that affect the Madrid Metro, the Barcelona tram network, the Valencia metro and tram service, the Mallorca Transport Consortium and the Avanza bus company.