Spanish police arrested a man in Palencia who they say supported pro-Russia hacktivist groups tied to attacks on critical infrastructure in Western countries. Police said the suspect had close ties to CyberArmy of Russia Reborn (CARR) and Z-Pentest, may have carried out actions for NoName057(16), helped a Ukrainian CARR member flee toward Russia via Poland and Belarus, and held seized computer equipment and cryptocurrency allegedly linked to cybercrime proceeds.
Why it matters: This signals continued international disruption of Russian-aligned hacktivist networks that have targeted public and private critical services, often with denial-of-service attacks that can still knock essential systems offline. Organizations in sectors such as energy, water, agriculture, and government should keep DDoS defenses and monitoring tuned for these actors.
2026.07.08
99% relevant
This article appears to be the same underlying event and adds details that Spanish police say the suspect helped a Ukraine-based CARR-linked hacker flee to Russia via Poland and Belarus, communicated with group members over encrypted apps, had cryptocurrency devices seized, and is being investigated for terrorism-related offenses and computer damage.
Bill Toulas
2026.07.07
99% relevant
This article is the same underlying event: Spain's arrest of a suspect in Palencia tied to CARR, Z-Pentest, and NoName057(16) following FBI-provided intelligence. It adds details that police say the suspect helped a Ukrainian hacker tied to CARR, tried to facilitate escape to Russia via Poland and Belarus, used encrypted messaging to coordinate support, and had crypto wallets frozen over alleged proceeds from stolen-data sales.
2026.07.07
100% relevant
This article establishes a discrete arrest and investigation in Spain tied to specific pro-Russia hacktivist groups, rather than updating an existing tracked breach, vulnerability, or advisory event.
← Back to all stories