Z-Pentest

Z-Pentest is a Russian-linked, pro-Kremlin hacktivist group focused on disrupting critical infrastructure through compromises of industrial control systems and supervisory control and data acquisition environments. It emerged in September 2024 as an offshoot of Cyber Army of Russia Reborn (CARR), incorporating CARR administrators and members of NoName057(16). Yuliya Pankratova is identified as its founder and leader. The group has links to the Russian state and operates within a wider ecosystem of pro-Russian disruptive actors, although its relationship with CARR does not establish that it shares CARR’s military-intelligence command structure. Z-Pentest predominantly targets exposed operational technology, including water, wastewater, energy, and industrial systems in the United States and Europe. Its tradecraft includes discovering internet-facing industrial interfaces through Shodan and FOFA, accessing inadequately secured VNC services, and attempting weak or default credentials. Once connected, attackers can manipulate human-machine interfaces and alter physical-process settings rather than relying on sophisticated exploitation. Danish authorities attributed the December 2024 attack on Tureby Alkestrup Waterworks to Z-Pentest. Manipulation of water pressure caused a pipe to burst and interrupted service to hundreds of households. In July 2026, Z-Pentest and BOUNTY JACKAL led an operation against Spanish public- and private-sector organizations, including legal entities. The European Union sanctioned Z-Pentest in July 2026 for attacks against critical infrastructure. Its operations align with pro-Russian geopolitical objectives, particularly pressure on countries supporting Ukraine. Although the group poses a demonstrated physical-disruption risk, its public claims can exaggerate the scope or impact of compromises.