Z-Pentest

Z-Pentest is a pro-Russian hacktivist group focused on disruptive and intrusive operations against critical infrastructure, particularly operational technology and industrial control system environments in the water, energy, food and agriculture sectors. The group is widely described as aligned with Moscow’s geopolitical objectives and as part of the broader Russian state-aligned hacktivist ecosystem, though reporting also indicates it emerged as an offshoot of Cyber Army of Russia Reborn (CARR) and NoName057(16) after internal fragmentation in late 2024. Public reporting places its formation in September 2024 and identifies it as composed of members drawn from CARR and NoName057(16). Z-Pentest is notable for shifting beyond the denial-of-service activity common among pro-Russian hacktivist brands toward direct OT intrusion operations. Its tradecraft has been associated with opportunistic targeting of internet-exposed remote access services and industrial interfaces, especially VNC-accessible human-machine interfaces, followed by abuse of weak, default, reused, or leaked credentials. Reported behaviors include scanning for exposed services, brute forcing or stuffing credentials, accessing HMI and SCADA environments, changing device names or parameters, disabling alarms, restarting or shutting down devices, and causing temporary loss of view for operators. The group also conducts defacement and hack-and-leak style activity to amplify propaganda value and publicize claimed impact. The actor has been linked to attacks and claimed intrusions affecting organizations in the United States and Europe. High-confidence reporting ties Z-Pentest to targeting Western water and energy utilities and to a destructive December 2024 cyberattack against a Danish water utility that altered water pressure and caused service disruption. It has also been identified in advisories and reporting as claiming compromises involving industrial networks, SCADA environments, and related systems, and as participating in broader campaigns against critical infrastructure entities across NATO-aligned countries. Z-Pentest is closely associated with CARR, NoName057(16), and Sector16, and is often discussed alongside other pro-Russian hacktivist groups that blend propaganda, disruptive cyber activity, and opportunistic OT targeting. Some assessments describe it as using similar tactics to CARR while specializing more heavily in OT intrusion operations and relying less on DDoS than companion groups. Public sanctions actions by the European Union have identified the group as a pro-Kremlin threat actor, and reporting has named Yuliya Pankratova as its founder or leader and Denis Degtyarenko as a key operator. Overall, Z-Pentest represents the evolution of Russian-aligned hacktivism from symbolic disruption toward low-to-moderate sophistication but operationally meaningful intrusion activity against exposed industrial environments.