Spain’s National Police have arrested a man in Palencia who is suspected of supporting the pro-Russian hacktivist groups CyberArmy of Russia Reborn and Z-Pentest, in a case that began in August 2025 and led to raids and asset freezes in March 2026.
KEY FACTS
- Arrest The suspect is accused of logistical and operational support for a Ukrainian hacker linked to CARR.
- Search Police raided a home in Palencia and seized computers and cryptocurrency storage devices.
- Funds Investigators froze cryptocurrency wallets linked to sales of stolen data.
- Probe The case started after information from the FBI.
According to a police announcement, the man tried to help the hacker escape to Russia through Poland and Belarus. The disclosure also says he used encrypted messaging apps to stay in contact with other members of these groups and to coordinate their activities.
The announcement says the suspect participated in actions attributed to NoName057(16), another pro-Russian hacktivist group. Those operations were later claimed on geopolitics-related websites and were aimed at promoting pro-Russian and anti-Western narratives.
The groups have been linked to attacks on critical infrastructure in the U.S. and Europe, including reported incidents involving water and food-processing facilities. Spanish police have not said whether the arrested man is accused of taking part in those attacks.
The police say no specific charges have been formally filed yet. The suspect is under investigation for alleged membership in and collaboration with a terrorist organization, glorification of terrorism and computer damage.
WHY IT MATTERS
The case shows how European and U.S. authorities are treating some hacktivist activity as a broader security threat, especially when it is tied to infrastructure targeting and financial activity. It also underscores the role of encrypted communications and cryptocurrency in investigations of politically motivated cybercrime.