07.07.2026
3 min
19
Spain’s National Police have arrested a man suspected of collaborating with the pro-Russian hacktivist groups Cyber Army of Russia Reborn (CARR) and Z-Pentest. According to investigators, he helped support the groups’ operations and maintained contact with other members.
Although hacktivism is typically associated with cyberattacks aimed at promoting political or ideological agendas rather than causing widespread damage, both CARR and Z-Pentest have been linked to a series of attacks targeting critical infrastructure across the United States and Europe.
U.S. authorities recently charged alleged CARR member Viktoriya Eduardovna Dubranova, accusing the group of carrying out cyberattacks against U.S. water utilities and food processing facilities, creating real risks to public safety.
The United States has also imposed sanctions on two other suspected CARR members, Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko, who have been linked to attacks on the SCADA systems of a U.S. energy company.
Researchers have also identified possible ties between CARR and the Russian state-backed threat group APT44, better known as Sandworm, which is believed to use hacktivist collectives as a cover for some of its operations.
According to Spain’s National Police, the suspect, a resident of the city of Palencia, provided logistical and operational support to a Ukrainian hacker working on behalf of CARR. Investigators also believe he attempted to help the hacker flee to Russia through Poland and Belarus.
“The suspect also used various encrypted messaging applications to maintain contact with other members of these terrorist groups, coordinating activities and providing support for their operations.”
Authorities also stated that, according to the investigation, the suspect participated in activities attributed to the pro-Russian hacktivist group NoName057(16).
“According to the investigation, the suspect participated in actions attributed to the pro-Russian hacktivist group NoName057(16). These operations were later claimed on specialized geopolitically oriented websites to promote pro-Russian and anti-Western narratives.”
The investigation began in August 2025 after Spanish authorities received information from the FBI. In March 2026, police searched the suspect’s home in Palencia, seizing computers and cryptocurrency storage devices that investigators believe could contain evidence relevant to the case.
Authorities also froze cryptocurrency wallets that were allegedly used to receive proceeds from criminal activity, including the sale of stolen data.
The suspect remains under investigation, and no formal charges have been filed so far. However, police said he is suspected of membership in and collaboration with a terrorist organization, promoting terrorism, and offenses involving damage to computer systems.
