Spain arrested a suspected CARR and Z-Pentest collaborator in an FBI-led probe for aiding pro-Russian hackers, coordinating attacks, and using crypto.
Spanish National Police arrested a man in Palencia last March on charges of membership in and collaboration with a terrorist organization, glorifying terrorism, and computer damage. The investigation, carried out jointly with the FBI, identified him as a collaborator of two pro-Russian hacktivist groups: CyberArmy of Russia Reborn (CARR) and Z-Pentest, both designated as terrorist organizations responsible for attacks against critical infrastructure in the United States and Europe.
“The investigation began last August when, thanks to information provided by the FBI, the National Police investigators were made aware of the alleged involvement of the detainee in actions aimed at providing logistical and support cover to a Ukrainian hacker, located in Ukraine, linked to the pro-Russian hacktivist group CyberArmy of Russia Reborn (CARR), in order to facilitate his escape to Russia, through Poland and Belarus.” reads the press release published by the Spanish Police.
The operational support the suspect allegedly provided — helping a foreign hacker evade capture by routing an escape through two countries — puts this well beyond keyboard activism.
“The suspect also used various encrypted messaging applications to maintain contact with other members of these terrorist groups, coordinating actions and providing support for their activities.” continues the report. “According to investigators, the detainee participated in actions attributed to the pro-Russian hacktivist group NoName057(16), whose operations were later claimed on specialized geopolitical websites, with the aim of disseminating pro-Russian and anti-Western narratives.”
Investigators also linked him to operations attributed to NoName057(16), another pro-Russian hacktivist group, whose attacks were subsequently claimed on geopolitical websites to spread pro-Russian and anti-Western messaging. The suspect was apparently keeping busy across multiple fronts simultaneously.
Police searched the suspect’s home in Palencia, seized computers and cryptocurrency storage devices, and froze a crypto wallet allegedly used to hold profits from selling stolen information.
The police pointed out that there was a financial dimension to the operation, with proceeds from the sale of stolen or compromised information flowing through crypto accounts.
The investigation was conducted by the General Information Commissariat of the National Police, the FBI, and the Provincial Information Brigade of Palencia, under the direction of the Central Court of Instance number One and the National Court’s Prosecutor’s Office. CARR and Z-Pentest have been active against water utilities, energy infrastructure, and industrial control systems across the US and Europe.
The arrest is one of the first in Spain connecting a domestic individual to the operational and logistical support layer that keeps these groups running, not just the keyboard operators, but the people helping them stay out of custody.
CyberArmy of Russia Reborn (CARR) is a pro-Russian hacktivist group known for targeting government agencies, critical infrastructure, and industrial systems across Europe and the United States, mainly through DDoS attacks and disruptive cyber operations.
Z-Pentest is another pro-Russian cyber group that supports similar campaigns, often coordinating attacks aligned with Moscow’s geopolitical interests. Both groups blend ideological messaging with offensive cyber activity and have been linked to attacks on energy, water, and public-sector organizations.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CARR)
