Spanish National Police have announced the arrest of a man believed to be an active member of the pro-Russian hacktivist groups **CyberArmy of Russia Reborn (CARR)** and **Z-Pentest**. While hacktivism traditionally aims to promote political messages, these groups are linked to attacks causing significant disruption and safety concerns. ### Targeting Critical Infrastructure A recent indictment of another alleged **CARR** member, **Victoria Eduardovna Dubranova**, revealed the group's involvement in cyberattacks against water and food-processing facilities in the U.S. Such actions highlight a dangerous escalation beyond mere messaging, creating tangible safety risks. The U.S. government has previously sanctioned other alleged members, **Yuliya Vladimirovna Pankratova** and **Denis Olegovich Degtyarenko**, for their roles in attacks targeting the SCADA systems of an American energy firm. ### Links to State-Backed APTs **CARR** has also been loosely associated with the Russian state-backed threat group **APT44**, also known as “**Sandworm**.” This connection is significant, as **Sandworm** is known for frequently masking its activities behind hacktivist collectives to obscure its state sponsorship. ### The Spanish Arrest The arrested individual, residing in Palencia, Spain, is suspected of providing logistical and operational support to a Ukrainian hacker operating for **CARR**. Investigators allege that the suspect attempted to facilitate the hacker's escape to Russia via Poland and Belarus. “The suspect also used various encrypted messaging applications to maintain contact with other members of these terrorist groups, coordinating activities and providing support for their operations,” stated the Spanish police announcement. Furthermore, the individual is believed to have participated in operations attributed to the pro-Russian hacktivist group **NoName057(16)**. These operations were subsequently claimed on geopolitics-related websites, aiming to promote pro-Russian and anti-Western narratives. ### Ongoing Investigation and Seizures The Spanish police initiated their investigation in August 2025, acting on intelligence provided by the **FBI**. In March 2026, authorities raided the suspect's home in Palencia, seizing computers and cryptocurrency storage devices crucial for ongoing investigations. Officers also froze cryptocurrency wallets suspected of holding proceeds from criminal activities, specifically the sale of stolen data. The arrested man is currently under investigation, facing potential charges related to membership in and collaboration with a terrorist organization, glorification of terrorism, and computer damage. No formal charges have been filed yet.