Spain collars alleged pro-Russia hacktivist after FBI tip-off
Palencia man suspected of links to CARR, Z-Pentest, and NoName057(16), plus helping a Ukrainian hacker flee to Russia
Spanish police have arrested a man they believe is affiliated with at least two pro-Russia hacktivist groups linked to attacks on critical national infrastructure (CNI).Arrested in March at his home in Palencia, central Spain, the man is suspected of having close ties to CyberArmy of Russia Reborn (CARR) and Z-Pentest, and may have carried out attacks on behalf of NoName057(16).All three hacktivist groups were named by the UK's NCSC earlier this year as part of an advisory warning about the dangers these groups pose to Western CNI.
The cyber arm of GCHQ, the UK's signals intelligence agency, said organizations should not underestimate pro-Russia hacktivist groups, despite them being known largely for relatively low-impact DDoS attacks.
Jonathon Ellison, NCSC director of national resilience, said at the time: "We continue to see Russian-aligned hacktivist groups targeting UK organizations, and although denial-of-service attacks may be technically simple, their impact can be significant."By overwhelming important websites and online systems, these attacks can prevent people from accessing the essential services they depend on every day."A month earlier, US officials said CARR was working with, or receiving instructions from, Russian military intelligence (GRU).Policía Nacional first announced the detention of the unidentified man on Monday, although the arrest was made months ago following an FBI tip-off.In August 2025, the feds alerted Spanish police to the man's alleged involvement in trying helping a Ukrainian hacker, a member of CARR, flee to Russia via Poland and BelarusHe was said to have provided "logistical and support cover" to facilitate the Ukrainian's escape.After the Palencia man's arrest, officers found evidence suggesting he was in close contact with other members of these pro-Russia hacktivist "terrorist groups." Police said he assisted in "coordinating actions and providing support" for the different outfits' activities, including those of NoName057(16).NoName057(16) has been active since at least 2022, and is known for targeting public and private organizations, NATO countries, and those whose interests do not align with Russia's.
