Spain detains man suspected of ties to pro-Russian hacktivist groups

Spanish National Police have arrested a man in Palencia who is believed to have supported the pro-Russian hacktivist collectives CyberArmy of Russia Reborn (CARR) and Z-Pentest. Authorities say the case is part of a broader investigation into online activity associated with groups that have been connected to disruptive attacks in Europe and the United States.

Support for an alleged CARR operator

According to police, the suspect is accused of providing logistical and operational help to a Ukrainian hacker who allegedly worked with CARR. Investigators also say he tried to arrange the hacker’s transfer to Russia via Poland and Belarus. The man is further suspected of using encrypted messaging services to stay in contact with other members of the network and assist with its activities.

Police said the suspect may also have participated in operations attributed to NoName057(16), another pro-Russian group known for online campaigns that promote pro-Russian and anti-Western messaging. Some of those incidents were later publicized on geopolitics-focused websites.

Investigation began after FBI tip

Spanish authorities opened the investigation in August 2025 after receiving information from the FBI. In March 2026, officers searched the suspect’s home and seized computers and cryptocurrency storage devices for forensic review. Officials also froze digital wallets they believe were used to receive proceeds from criminal activity, including the sale of stolen data.

The suspect has not yet been formally charged, but police say the investigation covers possible involvement in a terrorist organization, glorification of terrorism, and computer-related damage.

CARR has previously been tied to attacks against critical infrastructure and industrial systems, including reported activity aimed at water, food-processing, and energy-sector targets. U.S. officials have also sanctioned alleged members of the group in earlier cases.