Spain Arrests Suspected Supporter of Pro-Russian Hacktivist Networks Following FBI Intelligence

MADRID, Spain — Spanish authorities have arrested a man suspected of providing support to several pro-Russian hacktivist organizations after an international investigation, initiated with intelligence supplied by the Federal Bureau of Investigation (FBI), linked him to cyber groups accused of targeting governments and organizations supporting Ukraine.

The suspect, whose identity has not been publicly released, was arrested in March 2026 in the northern Spanish city of Palencia. According to Spanish law enforcement, investigators believe he maintained connections with CyberArmy of Russia Reborn (CARR), Z-Pentest, and NoName057(16)—three pro-Russian hacktivist groups that have repeatedly claimed responsibility for cyber operations directed against countries aligned with Ukraine since Russia’s full-scale invasion began in 2022.

Authorities allege the suspect provided logistical assistance to a Ukrainian hacker associated with CyberArmy of Russia Reborn by helping facilitate his planned escape to Russia through Poland and Belarus. Investigators also believe the suspect remained in regular contact with members of several pro-Russian cyber groups through encrypted messaging applications, where he allegedly coordinated activities and provided support for ongoing operations.

Spanish investigators further allege that the suspect assisted operations attributed to NoName057(16), one of the most active pro-Russian hacktivist organizations operating today. The group has become widely known for launching distributed denial-of-service (DDoS) attacks designed to overwhelm websites and online services belonging to governments, transportation systems, financial institutions, and public organizations supporting Ukraine. While many of the group’s attacks have focused on disrupting online services rather than stealing information, they have repeatedly demonstrated an ability to temporarily interrupt public-facing government and commercial websites across Europe and other allied nations.

During a court-authorized search of the suspect’s residence, investigators seized multiple computers, electronic storage devices, and cryptocurrency hardware believed to contain evidence relevant to the investigation. Authorities also froze a cryptocurrency wallet they believe received proceeds connected to information allegedly obtained through criminal cyber activity. Digital forensic specialists are continuing to analyze the seized equipment to determine the extent of the suspect’s communications, financial transactions, and possible involvement in additional cyber operations.

Spanish authorities stated that the suspect is currently under investigation for alleged membership in and collaboration with a terrorist organization, glorification of terrorism, and computer-related damage offenses. At this stage of the investigation, formal criminal charges have not yet been announced, and prosecutors continue reviewing evidence gathered during the operation.

The investigation highlights the increasingly international nature of modern cybercrime investigations. Intelligence supplied by the FBI helped Spanish authorities identify the suspect and begin an investigation that ultimately resulted in the arrest. As cyber threat actors routinely operate across multiple countries, law enforcement agencies have expanded intelligence sharing and joint investigations to identify individuals providing operational, financial, or logistical support to organized cyber networks.

CyberArmy of Russia Reborn, commonly referred to as CARR, emerged following the outbreak of the Russia-Ukraine conflict and has claimed responsibility for numerous cyber operations targeting critical infrastructure and government systems. Although some of its publicly claimed attacks have involved website disruptions and denial-of-service campaigns, Western governments have expressed growing concern about the group’s broader activities and possible relationships with more sophisticated cyber organizations.

Federal authorities in the United States have previously imposed sanctions against individuals alleged to be members of CyberArmy of Russia Reborn, accusing them of targeting elements of U.S. critical infrastructure, including water systems, hydroelectric facilities, wastewater operations, and portions of the energy sector. While many publicly reported incidents attributed to the group involved disruptive attacks rather than destructive intrusions, officials have warned that attacks against operational technology systems remain a serious national security concern.

Investigators are also examining the suspect’s alleged connections to Z-Pentest, another pro-Russian cyber group that has publicly supported Russian military objectives throughout the conflict. Although less publicly known than some other hacktivist organizations, Z-Pentest has been associated with coordinated cyber campaigns supporting broader pro-Russian online operations.

NoName057(16), meanwhile, has remained one of the most persistent pro-Russian hacktivist collectives since 2022. The organization has repeatedly claimed responsibility for cyberattacks targeting NATO member nations and other governments providing assistance to Ukraine. European law enforcement agencies have conducted multiple international operations against the group’s infrastructure, seizing servers and issuing arrest warrants in an effort to disrupt its activities. Despite those enforcement efforts, the group has continued claiming responsibility for attacks against public institutions and private organizations across Europe.

The seizure of cryptocurrency assets during the investigation also reflects the growing role digital currencies play within cybercrime ecosystems. Cryptocurrencies are frequently used to move funds across international borders, receive payments connected to cyber operations, and obscure financial transactions. Although blockchain transactions remain permanently recorded, investigators often rely on specialized forensic techniques to trace digital assets and identify individuals connected to criminal activity.

The case underscores the expanding cooperation between international law enforcement agencies as cyber investigations increasingly extend beyond national borders. As geopolitical tensions continue influencing cyber activity worldwide, authorities are placing greater emphasis on identifying not only the individuals carrying out attacks but also those accused of providing logistical, financial, or operational support that enables those campaigns to continue.

The investigation remains active as Spanish authorities continue reviewing digital evidence recovered during the search and coordinating with international partners to determine whether additional arrests or enforcement actions may follow.

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE