Flash Report: NoName057(16) Claims Spanish OT Access, Doxxes 18 Individuals

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 10:00 AM (EST) on November 11, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

• On November 10, 2026, ZeroFox observed the pro-Russia threat group NoName057(16) publish a post titled “NoName057(16) Tribunal” on its dark web site doxxing 18 individuals described as “citizens hostile to the Russian Federation.”
• On November 9, 2026, the group claimed on Telegram to have allegedly accessed the human-machine interface (HMI) and supervisory control and data acquisition (SCADA) system of a reverse osmosis installation allegedly associated with HIDROTEC Tratamiento de Aguas.
• The public exposure of private information—combined with cryptocurrency rewards offered for further data on targets and their relatives—very likely heightens the threat of online harassment, intimidation, and possible physical danger.
• ZeroFox has not confirmed any operational impact stemming from the HIDROTEC claim, which remains unverified and is likely minimal. Aside from its statement on Telegram, the group offered no proof of having gained access to or altering the operating mode of the reverse osmosis installation, and ZeroFox has not identified any facility operator, location, or operational disruption.

Overview

On November 10, 2026, ZeroFox observed the pro-Russia threat group NoName057(16) publish a post titled “NoName057(16) Tribunal” on its dark web site doxxing 18 individuals described as “citizens hostile to the Russian Federation.” On November 9, 2026, the group claimed on Telegram to have accessed the HMI and SCADA system of a reverse osmosis installation allegedly associated with HIDROTEC Tratamiento de Aguas—a Spain-based manufacturer and installer of water treatment equipment using membrane technology.

Doxxing is the publication of an individual’s private or identifying information (such as home address, phone numbers, email addresses, family details, or social media accounts) without their consent, typically with the intent to intimidate, harass, or expose them to harm.

Details

The actor’s November 10 post lists the individuals by name across three pages, each shown with a photograph. The listed individuals are likely perceived by NoName057(16) as acting against the group or Russian interests and include investigators, officials, politicians, mayors, and journalists.

Each profile discloses some or all of the following alleged personal information: date and place of birth, citizenship, phone number, Telegram username and ID, WhatsApp number, email addresses, social media accounts, occupation, and a free-text biography covering the individual’s career, family background, charitable activity, and commentary on their public statements.

The group does not state how it collected the information or what it intends to do with it.

NoName057(16)’s November 9 Telegram post describes the installation as a standard reverse osmosis skid with a fully open control interface. The group claims the access provides the full process diagram; manual control of high-pressure pumps and valves; flushing, drainage, and bisulfite dosing parameters; alarm setpoints for pressure, flow, and conductivity; switching between automatic and manual modes; live process readings; and active alarms. NoName057(16) also states that it switched the installation to manual mode, which produced an active low inlet pressure alarm, and that all key controls are available for direct action.

The post criticizes HIDROTEC Tratamiento de Aguas’ public image of quality and comprehensive solutions, contrasting it with the state of its control interface.

NoName057(16) is a long-standing pro-Russia hacktivist group with a history of both distributed denial-of-service (DDoS) attacks and, more recently, operational technology (OT)-focused claims. In 2025, Operation Eastwood saw 12 countries, together with Europol and Eurojust, shut down NoName057(16)’s botnet, taking over 100 servers offline. The group has continued to claim attacks against European targets since.

In early November, NoName057(16) and Z-Pentest claimed responsibility for attacks on European refrigeration systems in a now deleted post, though the claims remain unverified.¹

However, on November 9-10, 2026, French authorities formally attributed the October 2026 cyberattacks on commercial refrigeration systems at roughly 700 French retail sites to Iran’s Islamic Revolutionary Guard Corps (IRGC).²

Impact

Publishing personal details alongside cryptocurrency bounties for more information on targets and their families very likely creates a risk of harassment, intimidation, and physical-world targeting. Crowdsourced bounty models almost certainly widen the pool of people who may contribute data, which is likely to prolong exposure for those listed even if the site is taken down. For organizations, the greater risk is very likely to employees and officials in government, law enforcement, and media, who are likely to face targeted phishing, social engineering, or harassment built from the published data.

• The site offers cryptocurrency bounties for additional sensitive information on the targets and their family members. It has reportedly been accessible through Tor since late October.³
• Italian prosecutors have opened an investigation, assigned to specialists in the National Center for Cybercrime and the Protection of Critical Infrastructure (CNAIPIC), and Italian Foreign Minister Antonio Tajani said the campaign was intended to intimidate him over Italy’s support for Ukraine.⁴⁵

NoName057(16) has provided no evidence that it accessed the installation or changed its operating mode, and ZeroFox has not identified the operator, location, or any resulting disruption. If the access is genuine, switching an installation to manual mode typically signals a loss of automated control rather than a direct threat to water quality; plants with trained operators are typically capable of running manually. The broader significance is almost certainly reputational and strategic, as the claim reinforces a pattern of publicized OT intrusion claims against European entities (including recent claims against refrigeration systems) and it is likely to prompt scrutiny of internet-exposed HMIs at small integrators and the facilities they serve. Even unverified claims are likely to both force affected organizations to divert resources to investigation and response and undermine public confidence in critical services.

Outlook and Assessment

ZeroFox assesses NoName057(16) is likely to continue publishing OT access claims and adding entries to the Tribunal site in the near term, particularly against countries and individuals tied to support for Ukraine or to law enforcement action against the group. The Tribunal’s bounty model and the group’s use of Telegram for recruitment likely suggest it will continue attempting to crowdsource information and amplify its reach, despite continuing law enforcement pressure.

ZeroFox assesses that these activities likely reflect a broader effort to stay visible after Operation Eastwood, as there is a roughly even chance the doxxing is in retaliation for the takedowns although NoName057(16) has not stated this. The impact likely lies less in demonstrated disruption than in intimidation and publicity, though the doxxing very likely carries a more direct risk to personal safety.

1. hXXps://cybernews[.]com/security/russian-hackers-hacked-european-refrigeration-systems/ ↩︎
2. hXXps://cybernews[.]com/security/france-iran-eu-fridge-attacks/ ↩︎
3. hXXps://cybernews[.]com/security/noname057-eu-officials-doxxing/ ↩︎
4. hXXps://therecord[.]media/hackers-russia-italy-noname ↩︎
5. hXXps://www.ansa[.]it/english/news/politics/2026/11/09/prosecutors-open-probe-into-publication-of-tajanis-personal-data-on-dark-web_8ef9c158-a752-41b9-a82c-c79d66542803.html ↩︎