Counterintelligence — 2026-07-08

Spain Arrests Suspected Member of Pro-Russian Hacktivist Groups in FBI-Initiated Operation

BLUFFBI-initiated targeting of logistics support rather than operators likely produces formal charges within six months, broadening Western legal exposure for pro-Russian hacktivist networks beyond the hackers themselves.

Spain's National Police, coordinating with the FBI's Los Angeles field office as part of Operation Riptide, arrested a 34-year-old Italian national residing in Spain in Palencia on suspicion of membership in pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest 123. Police said the investigation opened in August 2025 after an FBI tip and that the arrest itself took place in March, with the case announced publicly on Monday 12. Investigators allege the suspect gave logistical support to a Ukrainian CARR hacker, helping arrange the hacker's escape to Russia through Poland and Belarus, and separately participated in actions attributed to NoName057(16) 123. Officers seized computers and cryptocurrency storage devices from his home and froze a cryptocurrency wallet allegedly used to receive payment 123. No formal charges have been filed; Spanish authorities cite suspected collaboration with a terrorist organization, glorification of terrorism, and computer damage 12.

Analysis
Absent named indicators of how Spanish prosecutors intend to proceed post-arrest, whether charges follow likely depends on evidence sufficiency from seized devices and crypto wallets still under analysis. Formal charges within six months is likely, consistent with Spain's Audiencia Nacional pattern of filing once digital forensics and financial tracing on frozen wallets are complete in comparable hacktivism cases. Analytic confidence is low, reflecting single-source reliance on the police announcement itself with no independent signal on prosecutorial timeline or evidentiary strength. The arrest disrupts CARR and Z-Pentest logistics networks tied to Ukrainian hackers' exfiltration routes through Poland and Belarus regardless of charging outcome.
4 sources
  1. Spain arrests suspected hacker linked to Russian hacktivist campaign - CyberScoop
  2. Spain arrests suspected member of pro-Russian hacktivist groups - BleepingComputer
  3. La Policía y el FBI detienen en Palencia a un presunto colaborador de hackers prorrusos - Euronews
  4. Spanish police arrest hacker accused of attacks on NATO, US Army - The Record

View in full brief →

UNCLASSIFIED // OPEN SOURCE