Counterintelligence — 2026-07-07

FBI and Spanish Police Arrest Alleged Cyber Army of Russia Reborn Member in International Counter-Cyber Operation

BLUFCross-group coordination exposed by the Palencia arrest confirms CARR, Z-Pentest, and NoName057(16) operate as a unified support network, making them vulnerable to the kind of bilateral law enforcement pressure now being applied.

Spanish National Police, working with the FBI's Los Angeles field office, arrested a man in Palencia on suspicion of collaborating with the pro-Russia hacktivist group Cyber Army of Russia Reborn (CARR), also known as Z-Pentest 12. El Español reports the FBI alerted Spanish authorities in August 2025 that the suspect, a Palencia resident, had allegedly provided logistical cover to help a Ukrainian hacker linked to CARR flee toward Russia through Poland and Belarus 2. Investigators say the man used encrypted messaging apps to coordinate with members of CARR, Z-Pentest, and the group NoName057(16), and in March searched his home, seizing computer equipment, cryptocurrency storage devices, and blocking a crypto wallet allegedly used to receive proceeds from the activity 2. The FBI and Spain's National Police said the operation falls under the FBI's Operation Riptide and ties into the bureau's Operation Red Circus campaign, announced in December, targeting Russian state-sponsored cyber threats to critical infrastructure 13.

Analysis
Spanish police and the FBI portray CARR, Z-Pentest, and NoName057(16) as an interlocking support network rather than isolated hacktivist brands, with the Palencia suspect providing both encrypted coordination and physical extraction help for a fleeing Ukrainian operative, a reading held with moderate confidence since it rests on a single Spanish police account that has not been independently corroborated. Reporting narrows to one primary source, El Español, with Hackread, The Register, and SC Media repackaging that account without independent verification, tying analytic confidence to one outlet's access to police material. The frozen cryptocurrency wallet points toward a parallel financial-forensics prosecution track distinct from the network's public claims of responsibility. The suspect's role may just as plausibly reflect peripheral facilitation rather than a central operational node, with Spanish publicity emphasizing cross-border cooperation for domestic political effect.

4 sources

FBI and Spanish Police Arrest Alleged Cyber Army of Russia Reborn Member - Hackread
La Policía Nacional, con la ayuda del FBI, detiene en Palencia a un hacker prorruso por delitos de terrorismo - El Español
Suspected pro-Russia hacktivist arrested in Spain with FBI support - SC Media
Alleged pro-Russia hacktivist arrested in Palencia - The Register