Spain's National Police have arrested a man in Palencia suspected of supporting two pro-Russian hacktivist groups - CyberArmy of Russia Reborn (CARR) and Z-Pentest. Authorities allege the suspect provided logistical and operational assistance to a Ukrainian hacker linked to CARR and helped plan an escape route to Russia through Poland and Belarus.
Police said the suspect communicated with other group members via encrypted messaging platforms and took part in activities attributed to the pro-Russian hacktivist collective NoName057(16). Authorities believe the operations were later promoted online to spread pro-Russian and anti-Western narratives.
The investigation began in August 2025 following intelligence provided by the US FBI. In March 2026, Spanish authorities searched the suspect's home in Palencia, seizing computers and cryptocurrency storage devices. They also froze digital wallets allegedly used to receive proceeds from the sale of stolen data.
CARR has been linked to cyberattacks targeting critical infrastructure in the United States and Europe, including attacks on water, food-processing, and energy facilities. The group has also been loosely associated with the Russian state-backed threat actor APT44 aka Sandworm. In July 2024, the US authorities have sanctioned two CARR members (a leader of the group and a main hacker) for their roles in cyber operations against US critical infrastructure.
The suspect remains under investigation and has not been formally charged. Spanish police said he is being investigated for alleged membership in and collaboration with a terrorist organization, glorification of terrorism, and computer-related offenses.