Spain's National Police have arrested an individual suspected of involvement with pro-Russian hacktivist organizations, including CyberArmy of Russia Reborn (CARR) and Z-Pentest. The suspect, who resided in Palencia, is alleged to have provided logistical and operational support to a Ukrainian hacker operating for CARR.
While hacktivism is often characterized by politically or ideologically motivated cyberattacks, CARR and Z-Pentest have been linked to attacks that posed risks to critical infrastructure in the United States and Europe. Previous indictments and sanctions against other alleged members of CARR have connected the group to cyberattacks targeting water and food-processing facilities, as well as SCADA systems of an American energy firm. CARR has also been loosely associated with the Russian state-backed threat group APT44, also known as Sandworm, which is known to disguise its activities behind hacktivist collectives.
According to Spanish police, the arrested individual facilitated a hacker's attempted escape to Russia via Poland and Belarus. The suspect reportedly used encrypted messaging applications to communicate with other members of these groups, coordinating activities and providing operational support. Investigators also believe the suspect participated in operations attributed to the hacktivist group NoName057(16), which later claimed responsibility for these actions on websites promoting pro-Russian and anti-Western narratives.
The investigation was initiated in August 2025 following information provided by the FBI. In March 2026, authorities executed a search of the suspect's home in Palencia, seizing computers and cryptocurrency storage devices for use in the ongoing investigation. Cryptocurrency wallets believed to have been used for receiving proceeds from the sale of stolen data were also frozen.
The suspect is currently under investigation and has not been formally charged. However, police are looking into potential offenses including membership in and collaboration with a terrorist organization, glorification of terrorism, and computer damage.
