Cyber Army of Russia Reborn

Cyber Army of Russia Reborn (CARR), also styled CyberArmyofRussia_Reborn, is a Russian state-linked, pro-Russian hacktivist group active since at least 2022. Linked to Russia’s military intelligence agency, the GRU, it conducts disruptive cyber operations in support of Russian geopolitical interests and the war against Ukraine. CARR has operational ties to Sandworm, also known as APT44. It is closely associated with the OT-focused group Z-Pentest, which has also been identified as a CARR alias in U.S. criminal proceedings. Its identified leadership includes Yuliya Pankratova, known as YUliYA, and primary hacker Denis Degtyarenko, known as Dena. CARR targets government agencies, financial institutions, media organizations, and critical infrastructure, particularly in the United States, Ukraine, and European countries supporting Ukraine. Its operations combine distributed denial-of-service attacks with compromises of industrial control systems at water, wastewater, energy, and food-processing facilities. The group exploits poorly secured internet-facing remote-access services, including Virtual Network Computing connections, to access operational technology. It enumerates exposed industrial systems and manipulates human-machine interfaces and SCADA controls, including pumps and alarms. Its activity has caused operational disruption and physical consequences, including overflowing water tanks and damage at food-processing facilities. CARR uses Telegram to coordinate activity, announce targets, claim responsibility, and publish photographs or videos of purported compromises. Its DDoS operations include the use of commercial DDoS-for-hire services. Although much of its tradecraft is relatively unsophisticated, access to inadequately secured industrial environments creates significant operational and public-safety risks. The group and its leading members have been subject to international sanctions and law-enforcement action.