Spain Arrests Man Suspected of Supporting Pro-Russian Hacktivist Groups
Summary
Spanish police arrested a man suspected of supporting CARR and Z-Pentest, aiding a CARR-linked hacker, and participating in operations attributed to NoName057(16). No formal charges have been filed; police seized devices and froze wallets.
Key points
- Spain’s National Police arrested a man in Palencia suspected of supporting CyberArmy of Russia Reborn (CARR) and Z-Pentest.
- Investigators allege he provided logistical and operational support to a Ukrainian hacker linked to CARR and tried to help him flee through Poland and Belarus.
- Police say the suspect used encrypted messaging apps and participated in actions attributed to NoName057(16).
- The investigation is linked to attacks targeting critical infrastructure, including water, food-processing, and SCADA systems.
- Police seized computers and cryptocurrency storage devices and froze wallets allegedly used to receive proceeds from stolen-data sales.
- The investigation began in August 2025 with information from the FBI; no specific charges have been formally filed.
Article Details
- Event Type
- Arrest and investigation of a man suspected of supporting pro-Russian hacktivist groups and assisting a CARR-linked hacker.
- Impact
- Investigators say the suspect provided logistical and operational support, attempted to help the hacker flee, and participated in actions attributed to NoName057(16). The article links the groups to attacks on critical infrastructure, including water, food-processing, and SCADA systems, and reports that police seized computers and cryptocurrency storage devices and froze wallets used to receive proceeds from stolen-data sales. The suspect remains under investigation, and no specific charges have been formally filed.
Threat Actors
CARRThe article describes CARR as a pro-Russian hacktivist group linked to attacks on critical infrastructure, including water and food-processing facilities. Spanish investigators say the arrested suspect supported a Ukrainian hacker who operated for CARR.Denis Olegovich DegtyarenkoThe article says the U.S. government sanctioned him as an alleged CARR member linked to attacks against an American energy firm's SCADA systems.NoName057(16)Spanish investigators say the suspect participated in actions attributed to this pro-Russian hacktivist group.SandwormThe article identifies Sandworm as an alias for APT44 and says CARR has been loosely linked to the group.SANDWORM RELICThe article says CARR has been loosely linked to APT44, described as a Russian state-backed threat group.Yuliya Vladimirovna PankratovaThe article says the U.S. government sanctioned her as an alleged CARR member linked to attacks against an American energy firm's SCADA systems.Z-PentestThe article identifies Z-Pentest as a pro-Russian hacktivist group and says the arrested man is suspected of being an active member. It describes the group alongside CARR as linked to attacks targeting critical infrastructure.
Countries
BelarusInvestigators say he tried to help the hacker flee to Russia through Poland and Belarus.PolandInvestigators say he tried to help the hacker flee to Russia through Poland and Belarus.RussiaSpain’s National Police arrested a man in Palencia suspected of supporting the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest.SpainSpain’s National Police arrested a man in Palencia suspected of supporting the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest.United Statesdamage, the two groups have been linked to multiple attacks targeting critical infrastructure in the U.S.
Industries
Energygovernment has previously sanctioned two more alleged members of the group, Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko, who were linked to attacks against the SCADA systems of an American energy firm.waterThe case is linked to attacks on critical infrastructure, including water, food-processing, and SCADA systems.