Cyber attacks on supermarket refrigerators, recorded first in France and then in several European countries, including Italy, had a new development on November 4, 2026. Two pro-Russian hacker groups, NoName057(16) and Z-Pentest, claimed responsibility for the tampering in a video released online. «There was no need for any malware. We simply exploited the integrated systems”, they claim in the message, also stating that they can target other infrastructures, including power plants and water systems.
Their responsibility, however, has not been confirmed: there is a lack of public evidence linking them to the episodes or demonstrating a common origin of the different cases. However, both are already known to the authorities for their activities against Western organizations and infrastructures. Their backgrounds help to understand how they operate and what role they have in the hacktivism phenomenon.
Who is NoName057(16): Cybercriminals who claim responsibility for hacker attacks on refrigerators
NoName057(16) has been active since March 2022, shortly after the Russian invasion of Ukraine. After mainly targeting sites and services in the country, it extended its campaigns to the states that support Kiev, focusing on public institutions, banks and transport services, including in Italy.
The group is best known for DDoS attacks (Distributed Denial of Service), which flood sites and online services with requests from multiple devices, to the point of slowing them down or making them temporarily unreachable. They do not necessarily involve an intrusion into the victim’s systems or theft of data.
To organize the offensives, the collective uses DDoSia, a tool that allows even people with limited computer skills to participate in the campaigns. Participants are recruited mostly via Telegram and some receive cryptocurrency rewards.
In July 2025 NoName057(16) was at the center of the Eastwood operation, coordinated by Europol and Eurojust with the involvement of several countries, including Italy. The intervention led to two arrests, seven arrest warrants and the interruption of over 100 servers used by the network. According to Europol, the group had around 4,000 supporters.
However, the operation did not stop its activities. In February 2026 NoName057(16) claimed responsibility for attacks against the sites of Italian diplomatic representations and hotels in Cortina, on the occasion of the Milan-Cortina Winter Olympics. He justified his actions with Italy’s support for Ukraine, but overall no significant disruptions were reported.
Who is Z-Pentest, the group sanctioned by the European Union
Z-Pentest was born in September 2024 from the initiative of some members of NoName057(16) and Cyber Army of Russia Reborn (CARR). According to a joint alert from Western agencies in December 2025, its birth followed disagreements in CARR over financial support from Russian military intelligence.
What distinguishes it from NoName057(16) are above all the intrusions into operational technology (OT) systems, used to control equipment and physical processes, from industrial machinery to devices that regulate essential services. Unauthorized access can modify operating parameters, with consequences related to the system and the protections present.
In the November 4 video, NoName057(16) and Z-Pentest claim to have tampered with Danfoss equipment and Dixell XWEB systems by exploiting functions already present in the devices, without resorting to malware. They also claim they can target water plants, power plants and other infrastructure. However, these statements do not prove their involvement in the supermarket incidents. The story also raised questions about the risks for canteens and health facilities.
On 13 July 2026, the European Union sanctioned Z-Pentest and two of its representatives, Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko. The EU Council attributes a December 2024 attack against a Danish water company to him and reports operations against critical infrastructure in the water and energy sectors.
Who else targeted Europe: CARR, Killnet and Dark Storm Team
Among the pro-Russian collectives is the aforementioned CARR, active since 2022. Initially involved in DDoS campaigns, it then claimed intrusions into industrial systems. In December 2025, the US Department of Justice announced the indictment of an alleged CARR member for several operations, including an attack on a meat processing plant in Los Angeles. The incident reportedly resulted in food spoilage and an ammonia leak in November 2024, according to the indictment.
According to Western security agencies, the GRU, Russian military intelligence, contributed to the birth of CARR and financed the tools used by the collective.
Another acronym is Killnet, which became known in 2022 for DDoS attacks against government sites, companies and organizations in Western countries. It also targeted European services. In June 2023 it announced the dissolution of the existing structure and in January 2024 a reorganization, so the acronym does not necessarily identify the original collective.
Other collectives include Dark Storm Team, which claimed responsibility for attacks against institutional sites and transport services, especially in Poland and Finland. In this case a clarification must be made: ENISA classifies it as pro-Palestinian and anti-Israeli, not pro-Russian. Groups with different orientations can target the same countries, as has already happened in Italy, without necessarily belonging to the same organization.
Why pro-Russian hackers attack European countries: the role of hacktivism
Hacktivism, a term born from the union of hacking and activism, consists of using IT tools to support political or ideological causes. Pro-Russian groups often present their actions as retaliation for aid to Ukraine, sanctions against Moscow or other decisions by Western governments. Even an international summit or a political declaration can become an opportunity to announce new attacks. These activities can fit into the broader context of hybrid warfare, which also includes cyber operations and other forms of pressure.
In 2025, 4,709 claims of attacks by hacktivist groups against targets in European Union countries were collected, and over 89% involved DDoS attacks. However, the figures refer to what the collectives said they had done, not to the number of attacks that actually succeeded or caused damage.
For many of these groups, propaganda also counts. On Telegram and other channels they announce targets, recruit supporters and publicize operations. According to a joint alert from Western agencies in December 2025, some collectives tend to exaggerate or invent the results of attacks, even if in certain cases actual damage was found.
Finally, the issue of relations with the Russian state remains. In the cases of NoName057(16) and CARR, Western authorities have identified links of a different nature with the Kremlin and Russian military intelligence. It does not mean that all pro-Russian groups are controlled by Moscow, nor that the incidents in supermarkets are attributable to Russia. Technical and investigative evidence is needed.
