Cyber Army of Russia Reborn

Cyber Army of Russia Reborn (CARR) is a pro-Russian hacktivist group active since 2022 that has conducted disruptive cyber operations in support of Russia’s geopolitical objectives, particularly in the context of the war against Ukraine. The group is widely tracked under the acronym CARR and has also been referred to as Z-Pentest in some reporting, though Z-Pentest is also described elsewhere as a closely linked associated group or offshoot. Cybersecurity and government reporting has linked CARR to Russian military intelligence, including assessments that the GRU supported its creation, direction, and tooling, and that it has maintained operational relationships with Sandworm and other GRU-linked elements. CARR has primarily targeted governments, public services, financial institutions, media organizations, and critical infrastructure in Ukraine, Europe, and North America, especially in countries supporting Ukraine. Its activity has included sustained distributed denial-of-service campaigns, disruptive intrusions, and operations affecting industrial and operational technology environments. Reported victim sectors include water and wastewater, energy, agriculture, food processing, and other industrial or public-sector environments. The group has repeatedly claimed responsibility for attacks through Telegram and other propaganda channels, using cyber operations as both a disruptive mechanism and an influence tool. The group’s tradecraft has often been characterized as opportunistic and comparatively unsophisticated, relying heavily on DDoS activity and exploitation of exposed or weakly secured internet-facing systems. At the same time, CARR has been associated with more serious activity involving industrial control and supervisory control environments, including abuse of exposed human-machine interfaces, virtual network computing access, weak credentials, and poorly secured remote administration paths. Multiple assessments note that while pro-Russian hacktivist actors frequently exaggerate impact, CARR-linked operations have nonetheless created real operational and public-safety risk in critical infrastructure environments. CARR operates within a broader ecosystem of pro-Russian state-aligned hacktivist and influence actors. It has been associated with NoName057(16), KillNet-affiliated activity, Sector16, Z-Alliance, TwoNet, and the Infrastructure Destruction Squad, and has been described as part of a wider Russian state-linked disruptive cyber and information operations landscape. Known individuals publicly tied to the group include Yuliya Pankratova, identified in sanctions and law-enforcement actions as a leader, and Denis Degtyarenko, identified as a principal hacker. Victoria Dubranova has also been charged by U.S. authorities for alleged support to CARR and NoName057(16). Cyber Army of Russia Reborn is best understood as a state-linked pro-Russian disruptive cyber actor that blends hacktivist branding, propaganda, volunteer-style mobilization, and deniable support to Russian intelligence objectives. Its significance lies less in advanced malware tradecraft than in its role as a persistent, politically aligned threat to critical infrastructure and public-sector targets, and as a bridge between overt hacktivism and covert state-directed cyber operations.