Pierluigi Paganini December 26, 2025

Pro-Russian hacking group Noname057 claimed responsibility for the cyberattack that recently disrupted La Poste’s digital banking and online services.

This week, the French national postal service La Poste confirmed a major cyber incident had knocked its information systems offline, disrupting digital banking and online services for millions of customers.

On social media, La Poste said the disruption temporarily rendered several platforms inaccessible, including its main website, mobile app, digital identity service, and the Digiposte document storage platform.

Some post office locations experienced service disruptions, though officials said customers could still conduct banking and postal transactions at service counters. The company confirmed that its online services: La Banque Postale online and the mobile app, laposte.fr, Digiposte, La Poste Digital Identity, and the La Poste application are temporarily inaccessible.

Some post offices may see temporary service disruptions, but counter services remain available as teams work to restore normal operations quickly. Banking customers can still make online payments with SMS authentication, withdraw cash, pay by card in stores, and use WERO transfers.

The pro-Russian hacking group, Noname057, claimed responsibility for a cyberattack the France’s national postal service days before Christmas. French prosecutors said the French intelligence agency DGSI took over the investigation.

La Poste confirmed a DDoS attack knocked core systems offline, causing service disruptions.

In July, European and U.S. authorities disrupted the activities of the pro-Russian hacktivist group NoName057(16) in Operation Eastwood.

Operation Eastwood disrupted NoName057(16)’s infrastructure, taking down over 100 systems and key central servers. Authorities issued seven arrest warrants, including six targeting Russian nationals, two of whom are accused as the main instigators. Suspects are internationally wanted, with five listed on the EU Most Wanted site. Hundreds of group supporters were warned about their legal liability for aiding the group’s DDoS attacks, often driven by pro-Russian ideology.

Operation Eastwood struck a major blow to the pro-Russian hacker group NoName057(16). Authorities carried out two arrests, one in France and another in Spain, and issued seven arrest warrants, six by Germany and one by Spain. Law enforcement conducted 24 house searches across multiple countries, including Czechia, France, Germany, Italy, Spain, and Poland. Thirteen individuals were questioned, and over 1,000 supporters, 15 of them administrators, were notified via messaging apps about their legal responsibility.

The pro-Russian hacker group NoName057(16) has ramped up DDoS attacks against countries supporting Ukraine, many of them NATO members. Since 2023, they’ve targeted Swedish government and banking sites, hit over 250 German entities in 14 attack waves, and disrupted events in Switzerland, including the Ukraine Peace Summit. Dutch authorities also linked them to an attack during the recent NATO summit. Thankfully, all incidents were mitigated without major disruptions.

The pro-Russian hacker group has over 4,000 supporters and employed a self-built botnet composed of hundreds of servers. The group spreads propaganda and recruits through social media, forums, and niche chat apps. Using platforms like DDoSia, they lower technical barriers.

Pro-Russia hacktivist groups like CARR, Z-Pentest, and NoName057(16) exploit poorly secured VNC connections to access OT devices in critical infrastructure, causing varying impacts, including physical damage, primarily targeting water, food, agriculture, and energy sectors. Their attacks are less sophisticated and lower-impact compared to APT groups.

“This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology and European Cybercrime Centre’s (EC3) Operation Eastwood, in which CISA, Federal Bureau of Investigation (FBI), Department of Energy (DOE), Environmental Protection Agency (EPA), and EC3 shared information about cyber incidents affecting the operational technology (OT) and industrial control systems (ICS) of critical infrastructure entities in the United States and globally.” reads a joint advisory from FBI, CISA, National Security Agency (NSA), and partners countries.

CARR attacked U.S. water systems and a Los Angeles meat facility, causing spills, leaks, and damage. GRU guidance financed attacks, targeting critical infrastructure and election sites. A GRU-linked officer, using the handle “Cyber_1ce_Killer,” directed CARR targets, funded DDoS-for-hire services, and is identified as a CARR member.

The U.S. State Department offers up to $2 million for information on CARR members and up to $10 million for details on individuals linked to NoName.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini****

(SecurityAffairs** – hacking, La Poste)**