Spanish police have arrested an alleged member of the pro-Russia hacktivist group Cyber Army of Russia Reborn, also known as Z-Pentest, in an operation carried out with support from the FBI. The arrest forms part of ongoing measures to identify and disrupt people involved in cyberattacks targeting critical infrastructure.
The FBI confirmed that its Los Angeles field office worked with Spain’s National Police to coordinate the arrest. US authorities said the action falls under Operation Riptide, an international effort aimed at disrupting malicious cyber activity and holding those responsible accountable.
The arrest also fits into the FBI’s wider Operation Red Circus campaign, announced in December 2025 to counter Russian state-sponsored cyber threats affecting the United States and allied interests. As part of that initiative, the FBI and several government partners published a joint Cybersecurity Advisory warning that pro-Russia hacktivist groups had been carrying out opportunistic attacks against critical infrastructure, including organizations in the water, agriculture, and energy sectors.
Spain’s National Police announced the arrest in a separate statement but has not publicly released the suspect’s identity. Authorities also have not disclosed specific charges or provided details about the individual’s alleged role within the group. The investigation remains ongoing.
Detenido un presunto colaborador de los grupos terroristas hacktivistas #prorrusos CyberArmy of Russia Reborn (CARR) y Z-Pentest
Autores de múltiples ataques contra infraestructuras críticas en #EEUU y #Europa
El detenido mantenía contacto con integrantes de distintos… pic.twitter.com/dx4kiePdJ8— Policía Nacional (@policia) July 6, 2026
Cyber Army of Russia Reborn has been active since Russia invaded Ukraine and has repeatedly claimed responsibility for distributed denial-of-service attacks (DDoS attacks) and other disruptive cyber operations against government agencies, public services, and private organizations in countries supporting Ukraine. Security researchers have also linked the group to campaigns targeting industrial control systems (ICS) and critical infrastructure.
Previous Arrest
This is not the first time authorities have taken action against people linked to pro-Russia hacktivist operations. In December 2025, US authorities took custody of a Ukrainian woman, Victoria Dubranova, also known as “Vika,” a.k.a. “Tory,” a.k.a. “SovaSonya,” accused of helping the pro-Russia hacking group NoName057(16), another collective known for launching DDoS attacks against governments and public institutions in Europe.
The latest arrest highlights the continued cooperation between US and European law enforcement agencies as they go after people accused of participating in cybercrime and politically motivated hacking campaigns. Both the FBI and Spain’s National Police said they will continue working with international partners to investigate and disrupt malicious cyber activity.
(Photo by Sasun Bughdaryan on Unsplash)
