NoName057(16) and Z-Pentest claim to have hit European supermarket refrigerators, but their responsibility is not confirmed. Who they are, what operations they have conducted in the past and why hacktivists are targeting European countries.
The cyber attacks on supermarket refrigeratorsregistered first in France and then in several European countries, including Italy, have had a new development November 4, 2026. Two groups pro-Russian hackers, NoName057(16) And Z-Pentestthey have claimed the tampering in a video released online. «There was no need for any malware. We simply exploited the integrated systems”, they claim in the message, also stating that they can target other infrastructures, including power plants and water systems.
Their responsibility, however, has not been confirmed: there is a lack of public evidence linking them to the episodes or demonstrating a common origin of the different cases. However, both are already known to the authorities for their activities against Western organizations and infrastructures. Their backgrounds help to understand how they operate and what role they have in the phenomenon ofhacktivism.
Who is NoName057(16): Cybercriminals who claim responsibility for hacker attacks on refrigerators
NoName057(16) has been active since March 2022shortly after the Russian invasion of Ukraine. After mainly targeting sites and services in the country, it extended its campaigns to the states that support Kiev, focusing on public institutions, banks and transport services, including in Italy.
The group is best known for DDoS attacks (Distributed Denial of Service)which flood sites and online services with requests from multiple devices, to the point of slowing them down or making them temporarily unreachable. They do not necessarily involve an intrusion into the victim’s systems or theft of data.
To organize offensives, the collective uses DDoSiaa tool that allows even people with limited IT skills to participate in campaigns. Participants are recruited mostly via Telegram and some receive cryptocurrency rewards.
In July 2025 NoName057(16) was at the center of theOperation Eastwoodcoordinated by Europol and Eurojust with the involvement of several countries, including Italy. The intervention led to two arrests, seven arrest warrants and the termination of over 100 servers used by the network. According to Europol, the group had around 4,000 supporters.
However, the operation did not stop its activities. In February 2026 NoName057(16) claimed attacks against the sites of Italian diplomatic missions and hotels in Cortinaon the occasion of the Milan-Cortina Winter Olympics. He justified his actions with Italy’s support for Ukraine, but overall no significant disruptions were reported.
Who is Z-Pentest, the group sanctioned by the European Union
Z-Pentest was born in September 2024 by the initiative of some members of NoName057(16) e Cyber Army of Russia Reborn (CARR). According to a joint alert from Western agencies in December 2025, its birth followed disagreements in CARR over financial support from Russian military intelligence.
What distinguishes it from NoName057(16) are above all the intrusions into the systems operational technology (OT)used to control physical equipment and processes, from industrial machinery to devices that regulate essential services. Unauthorized access can modify operating parameters, with consequences related to the system and the protections present.
In the November 4 video, NoName057(16) and Z-Pentest claim to have tampered with Danfoss equipment and Dixell XWEB systems by exploiting functions already present in the deviceswithout resorting to malware. They also claim they can hit water systems, power plants and other infrastructure. However, these statements do not prove their involvement in the supermarket incidents. The story also raised questions about the risks for canteens and health facilities.
July 13, 2026 the European Union has sanctioned Z-Pentest and two of its representatives, Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko. The EU Council attributes a December 2024 attack against a Danish water company to him and reports operations against critical infrastructure in the water and energy sectors.
Who else targeted Europe: CARR, Killnet and Dark Storm Team
Among the pro-Russian collectives is the aforementioned CARRactive since 2022. Initially engaged in DDoS campaigns, it then claimed intrusions into industrial systems. In December 2025, the US Department of Justice announced the indictment of an alleged CARR member for several operations, including an attack on a meat processing plant in Los Angeles. The incident reportedly resulted in food spoilage and an ammonia leak in November 2024, according to the indictment.
According to Western security agencies, the CRANERussian military intelligence, would have contributed to the birth of CARR and financed the tools used by the collective.
Another acronym is Killnetwhich became known in 2022 for DDoS attacks against government sites, companies and organizations in Western countries. It also targeted European services. In June 2023 it announced the dissolution of the existing structure and in January 2024 a reorganization, so the acronym does not necessarily identify the original collective.
Among other collectives it appears Dark Storm Teamwhich claimed attacks against institutional sites and transport services, especially in Poland and Finland. In this case a clarification must be made: ENISA classifies it as pro-Palestinian and anti-Israelinot pro-Russian. Groups with different orientations can target the same countries, as has already happened in Italy, without necessarily belonging to the same organization.
Why pro-Russian hackers attack European countries: the role of hacktivism
THE’hacktivisma term born from the union of hacking and activism, consists ofuse IT tools to support political or ideological causes. Pro-Russian groups often present their actions as retaliation for aid to Ukraine, sanctions against Moscow or other decisions by Western governments. Even an international summit or a political declaration can become an opportunity to announce new attacks. These activities can fit into the broader context of hybrid warfarewhich also includes cyber operations and other forms of pressure.
In 2025 they were collected 4,709 claims of attacks by hacktivist groups against targets in European Union countries e over 89% it involved DDoS attacks. However, the figures refer to what the collectives said they had done, not to the number of attacks that actually succeeded or caused damage.
For many of these groups, the propaganda. On Telegram and other channels they announce targets, recruit supporters and publicize operations. According to a joint alert from Western agencies in December 2025, some collectives tend to exaggerate or invent the results of attacks, even if in certain cases actual damage was found.
Finally, there remains the theme of relations with the Russian state. In the cases of NoName057(16) and CARR, Western authorities have identified links of a different nature with the Kremlin and Russian military intelligence. It does not mean that all pro-Russian groups are controlled by Moscow, nor that the incidents in supermarkets are attributable to Russia, Technical and investigative feedback is needed.
