Loading story…
Spanish police, with FBI support, arrested a man in Palencia suspected of supporting the pro-Russia hacktivist groups Cyber Army of Russia Reborn (CARR) and **Z-Pentest`, authorities said. Investigators believe the suspect had close ties to the groups, may have carried out attacks on behalf of NoName057(16), and was linked to cyber operations targeting critical national infrastructure in countries backing Ukraine. Police searched his home, seized computer equipment and cryptocurrency storage devices, and froze a wallet suspected of holding proceeds tied to cybercrime.
Authorities also said the suspect helped a Ukrainian CARR member flee toward Russia through Poland and Belarus after an FBI tip-off in August 2025. The arrest forms part of wider US-European efforts to identify and disrupt politically motivated pro-Russia cyber actors, including Operation Riptide and the FBI’s Operation Red Circus. Officials have not publicly identified the suspect or disclosed specific charges, and the investigation remains ongoing.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Spanish National Police arrested the Palencia resident in July 2026 as part of an investigation into alleged support for pro-Russian hacktivist groups including CARR, Z-Pentest, and NoName057(16). Authorities said no formal charges had yet been filed and that he was being investigated for terrorism-related offenses and computer damage.
The FBI launched Operation Red Circus in December 2025 as a campaign to counter Russian state-sponsored cyber threats. Later reporting said the March 2026 Spanish arrest aligned with this broader effort and with Operation Riptide.
During the Palencia operation, investigators seized computer equipment and cryptocurrency storage devices from the suspect's home. Authorities also froze a wallet suspected of holding proceeds from cybercrime.
Spanish police arrested a man in Palencia in March 2026 on suspicion of supporting pro-Russia hacktivist groups linked to attacks on critical national infrastructure. Authorities said he had close ties to Cyber Army of Russia Reborn and Z-Pentest and may also have conducted attacks for NoName057(16).
After an FBI tip-off in August 2025, a Ukrainian member of Cyber Army of Russia Reborn was helped to flee toward Russia via Poland and Belarus, according to investigators. Authorities allege the Palencia suspect assisted in that escape.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourcehackread.com
Open sourcerewardsforjustice.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice announced two indictments against Ukrainian national **Victoria Eduardovna Dubranova**, alleging she supported the pro-Russia hacking groups **CyberArmyofRussia_Reborn (CARR)** and **NoName057(16)** in cyberattacks against critical infrastructure and other targets worldwide. U.S. prosecutors said Dubranova was extradited to the United States and pleaded not guilty in both cases, while the government described CARR as founded, funded, and directed by Russia’s **GRU** and characterized NoName057(16) as a state-sanctioned project linked in part to Russia’s Center for the Study and Network Monitoring of the Youth Environment (**CISM**). According to the indictments, CARR targeted U.S. public water systems, a Los Angeles meat processing facility, election infrastructure, and nuclear regulatory websites, while NoName057(16) used its **DDoSia** platform and a global volunteer network to disrupt government agencies, financial institutions, railways, ports, and other critical infrastructure. The Justice Department said the criminal cases were paired with broader U.S. government action, including State Department reward offers, a joint cybersecurity advisory, and references to earlier **OFAC** sanctions against two alleged CARR members.
Aug 14, 2026
An international law enforcement operation disrupted **NoName057(16)**, a pro-Russian hacktivist network accused of launching distributed denial-of-service attacks against Ukraine and countries supporting Kyiv, including EU and NATO members. Europol and Eurojust said **Operation Eastwood** took more than 100 servers offline, dismantled a significant portion of the group’s infrastructure, and led to arrests, arrest warrants, house searches, and interviews across multiple countries with U.S. support. Investigators said the group relied on automated tooling, botnet infrastructure, and the **DDoSia** platform, while recruiting participants through social media, messaging channels, cryptocurrency payments, and gamified incentives such as leaderboards and badges. U.S. authorities later tied the disruption to broader action against Russian state-backed cyber actors, unsealing indictments against **Victoria Eduardovna Dubranova** for allegedly supporting both **NoName057(16)** and **CyberArmyofRussia_Reborn (CARR)**. The Justice Department said the groups carried out hundreds of attacks worldwide, including activity targeting U.S. critical infrastructure such as public water systems and election infrastructure, and described NoName as a state-sanctioned project linked to Russian organization **CISM**. A related CISA advisory warned that pro-Russia hacktivists were conducting attacks against critical infrastructure, reinforcing concerns that ideologically branded DDoS campaigns are being used to advance Russian geopolitical objectives.
Aug 14, 2026
Poland’s Central Bureau for Combating Cybercrime (**CBZC**) arrested a 20-year-old suspected of conducting **global DDoS attacks** against high-profile and strategically important websites. Authorities said the suspect used a multi-layered botnet control architecture involving **C2 “stressers”** and **command-and-control nodes (CNC)**, and seized computer equipment allegedly used to host and distribute DDoS tooling; the suspect reportedly confessed to most charges, was released on bail after a formal statement, and faces up to five years in prison if convicted. Separately, Polish authorities detained a 60-year-old civilian employee in the Ministry of National Defense’s strategy and planning department on suspicion of **espionage** for a foreign intelligence service, with Polish officials indicating links to **Russian and Belarusian** services. Counterintelligence searched the suspect’s office and residence and seized phones, computers, and storage media; prosecutors filed espionage charges while officials cited “extensive evidence” and framed the case as part of broader **hybrid warfare** pressure on Poland, including sabotage, disinformation, and cyber activity attributed to Russia-linked actors.
Jun 29, 2026