Spanish police arrest Palencia man suspected of aiding pro-Russia hacktivists

Spanish police have arrested a man in Palencia whom investigators believe maintained ties to several pro-Russia hacktivist groups connected to attacks on critical infrastructure. The detention, which took place in March and was disclosed publicly this week, followed information shared by the FBI.

According to authorities, the suspect is thought to have links to CyberArmy of Russia Reborn (CARR) and Z-Pentest, and may also have supported operations attributed to NoName057(16). Police say the investigation suggests he helped coordinate activity for these networks and provided logistical support in at least one case involving the escape of a Ukrainian hacker.

Officials said the FBI alerted Spanish counterparts in August 2025 about the man’s alleged role in helping a member of CARR leave Ukraine and travel to Russia through Poland and Belarus. Investigators described the assistance as covering transport and other support measures needed to facilitate the move.

Evidence gathered after the arrest

Police reported that searches of the suspect’s home turned up computer equipment and cryptocurrency storage devices. Investigators also froze a digital wallet they believe may contain criminal proceeds. Authorities said the material recovered points to contact with other members of the pro-Russia groups and to involvement in coordinating their activities.

The case comes as Western security agencies continue to warn about the risks posed by hacktivist collectives aligned with Moscow. While many of these groups are best known for distributed denial-of-service campaigns, officials say the disruption can still be significant when public services or infrastructure operators are targeted.

Broader pressure on pro-Russia groups

• The UK’s National Cyber Security Centre has warned that these groups should not be dismissed because of the apparently simple nature of some of their attacks.
• US officials have said CARR has operated with support from or under the direction of Russian military intelligence.
• Previous enforcement actions have linked pro-Russia hacktivists to incidents involving water, energy and manufacturing systems.

Spanish authorities have not publicly named the suspect, and the case remains under investigation. The arrest adds to a growing international effort to identify individuals who support or enable cyber operations tied to pro-Russia hacktivist activity.