Spain’s National Police arrested a man in Palencia who they say was an active member of two pro-Russian hacktivist groups: CyberArmy of Russia Reborn (CARR) and Z-Pentest.
The guy wasn’t running the attacks himself. Cops say he provided logistical and operational support to a Ukrainian hacker who operated for CARR. He also allegedly tried to help that hacker escape to Russia through Poland and Belarus.
He kept in touch with other group members through encrypted messaging apps, coordinating ops and sharing support. Investigators say he was involved in actions linked to another pro-Russian group, NoName057(16). Those ops were later claimed on geopolitics websites to push pro-Russian, anti-Western narratives.
The FBI gave Spanish authorities the tip that kicked off the investigation back in August 2025. By March 2026, they raided the suspect’s home, seized computers and crypto storage devices, and froze cryptocurrency wallets they say were used to receive crime proceeds — specifically money from selling stolen data.
CARR’s no joke. A recent indictment of another alleged member, Victoria Dubranova, revealed the group hit water and food-processing facilities in the US, creating real safety risks. The US government has already sanctioned two other alleged CARR members linked to attacks on an American energy firm’s SCADA systems. CARR also has loose ties to Russia’s Sandworm group (APT44), known for hiding behind hacktivist fronts.
Right now the suspect is under investigation. No formal charges filed yet, but the police announcement mentions suspected membership in and collaboration with a terrorist organization, glorification of terrorism, and computer damage.
