Spanish National Police have detained a man suspected of actively participating in the activities of pro-Russian hacker groups, including Cyber Army of Russia Reborn (CARR), also known as Z-Pentest, and having links to NoName057(16). The arrest took place in March 2026 in the city of Palencia (northern Spain), but the information was made public recently.
The operation was carried out based on a tip from the FBI, which provided key data in August 2025. The suspect, whose name has not been disclosed, is accused of providing logistical and operational support to a Ukrainian hacker associated with CARR, including helping organize his escape to Russia via Poland and Belarus.
According to a statement from Spain’s Interior Ministry, the man is suspected of:
Membership in and collaboration with a terrorist organization;
Glorification of terrorism;
Computer crimes (including participation in DDoS attacks and other cyber operations targeting critical infrastructure in the United States and Europe).
During a search of his home, authorities seized computers and cryptocurrency storage devices. The investigation is ongoing.
Cyber Army of Russia Reborn (CARR / Z-Pentest) is one of the most active pro-Russian hacker groups, known for DDoS attacks and other operations against government agencies, companies, and infrastructure in countries supporting Ukraine. The group is closely linked to other hacktivist collectives acting in Russia’s interests.
The arrest is part of a broader FBI operation (including Operation Red Circus / Riptide) aimed at disrupting pro-Russian hacker networks. The cooperation between Spanish police and U.S. agencies highlights the West’s growing efforts to counter cyber threats linked to geopolitical conflict.
The suspect remains under investigation, and formal charges have not yet been filed.