Executive Summary

NoName057(16) published a message on the anniversary of Operation Eastwood, the coordinated international action carried out in July 2025 against members and infrastructure of the group. In the communication, the actor ridicules European efforts, rejects the idea that its infrastructure was destroyed and presents its continuity as proof of ideological and operational resilience.

The message combines pro-Russian propaganda, a survival narrative and a new series of German targets linked to logistics, ports and associated services. Among the targets mentioned are the Port of Kiel, STEX GmbH, LIMANi Supply Group, an internal service of Pamyra and ESMZ, the Port of Kiel authorization portal.

NoName057(16) uses the anniversary of an international law enforcement operation not only to claim continuity, but also to transform a defensive law enforcement action into a propagandistic milestone of retaliation.

Key Judgments

• NoName057(16) leverages the anniversary of Operation Eastwood to reinforce a survival narrative in the face of European law enforcement actions.
• The actor frames the 2025 international operation as a failure and states that the group does not depend solely on infrastructure, tools or services, but on an idea sustained by people.
• The selection of German targets associated with ports, logistics and internal services is consistent with the group’s pattern of conducting pressure-oriented DDoS activity against countries perceived as adversaries of Russia.
• The publication does not allow sustained impact or significant operational degradation against the targets to be confirmed, but it does function as a signal of activity, propaganda and continuity.
• The immediate value of the indicator lies in the conversion of Operation Eastwood into a narrative resource to motivate the actor’s community and sustain harassment campaigns.

What Happened

NoName057(16) disseminated a message recalling Operation Eastwood and accusing German and European authorities of attempting to attribute its activities to specific individuals and of spreading a narrative about the “destruction” of its infrastructure.

One year later, the actor presents that effort as failed. The publication states that NoName057(16) “cannot be destroyed” because, according to its own narrative, it is not merely a collection of machines, tools, scripts or services, but an idea backed by people.

In the same message, the actor lists new targets in Germany and accompanies each one with links to availability reports on check-host. The declared targets include the Port of Kiel, STEX GmbH, LIMANi Supply Group, an internal service linked to Pamyra and ESMZ, the Port of Kiel authorization portal used by employees or partners.

The publication uses hashtags such as #FuckEastwood, #TimeOfRetribution and #OpGermany, reinforcing the framing of retaliation and operational continuity.

Operational Assessment

NoName057(16) once again relies on a known modality: the selection of symbolically relevant targets, the publication of availability reports and the construction of a political narrative around the action. In this case, the differentiating component is the use of the anniversary of Operation Eastwood as a communication trigger.

Rather than accepting Eastwood as a blow against its ecosystem, the actor transforms it into a date of mobilization, ridicule and retaliation. This resignification is important because it allows the group to sustain internal morale, show continuity to its audience and present any subsequent activity as proof of survival.

The selection of German targets linked to ports, logistics and internal services also adds analytical value. Although a DDoS does not imply access to internal systems or data compromise, the temporary disruption of public or corporate services associated with transport and logistics can generate significant visibility, reputational pressure and a perception of disruption.

Intelligence Significance

Operation Eastwood becomes, in this case, a propagandistic input. The actor uses it to ridicule authorities, reaffirm collective identity and turn law enforcement pressure into a reason for mobilization. This dynamic suggests that law enforcement actions can reduce operational capability, but they can also be narratively exploited by the affected groups.

For CTI and defense teams, the signal requires monitoring of German targets associated with logistics, ports and auxiliary services. The priority is not to treat the event as an intrusion, but as DDoS harassment with a political function.

Analytical Closing

NoName057(16) used the anniversary of Operation Eastwood to publish a new declared action against German logistics and port targets, framed as retaliation and proof of survival.

Until additional technical evidence becomes available, iQBlack assesses the case as an indicator of DDoS continuity and resilience propaganda, not as confirmation of technical compromise against the mentioned targets.

The immediate intelligence value lies in how the actor turns an international law enforcement disruption operation into a narrative milestone of its own.