DOJ Announces Actions Against Alleged Key Member of Russian Cybercriminal Groups NoName057(16) and CARR (Z-Pentest)

Summarize with:

ChatGPT Claude.ai Google AI Grok Perplexity

Add as preferred source on Google

Key Takeaways

• Indictment: A Ukrainian national has been indicted in the U.S. for her alleged role in two Russian-backed cybercriminal groups.
• Targeted groups: The operations targeted the Cyber Army of Russia Reborn (CARR) and NoName057(16), both known for attacking critical infrastructure.
• State sponsorship: U.S. authorities allege both groups were backed by the Russian government, with CARR allegedly funded and directed by Russia's GRU.

The U.S. Department of Justice has announced two indictments against Ukrainian national Victoria Eduardovna Dubranova, 33, who was extradited to the U.S. and is charged for her alleged supporting roles in the CARR and NoName057(16) hacking groups, which have conducted destructive cyberattacks against global targets, including U.S. critical infrastructure. 

The indictments detail that Dubranova, also known as Vika, Tory, and SovaSonya, was allegedly involved in conspiracies to damage protected computer systems and tamper with public water systems. If convicted, Dubranova would face a statutory maximum penalty of 27 years in federal prison.

Destructive Attacks on Critical Infrastructure

According to the indictments, both groups operated in support of Russia's geopolitical interests. CARR, also known as Z-Pentest, reportedly founded and directed by Russia's Main Directorate of the General Staff (GRU), claimed responsibility for hundreds of attacks. 

These include compromising public drinking water systems across several U.S. states and attacking a meat processing facility in Los Angeles in November 2024, resulting in physical damage and spoilage.

NoName057(16) is described as a state-sanctioned project that developed its own proprietary DDoS tool, "DDoSia," to attack government agencies, financial institutions, and infrastructure like railways and ports. 

The group allegedly recruited volunteers and offered cryptocurrency rewards for participation. These operations highlight the tangible cybersecurity threats posed by state-backed hacktivist groups.

The CARR indictment charges Dubranova with:

• one count of conspiracy to damage protected computers and tamper with public water systems, 
• one count of damaging protected computers, 
• one count of access device fraud, 
• one count of aggravated identity theft.

Coordinated Government Response and Rewards

In conjunction with the DOJ cybercrime actions, other U.S. agencies have issued a joint cybersecurity advisory (PDF). This advisory warns that pro-Russia hacktivists are targeting minimally secured systems to infiltrate operational technology within critical infrastructure. 

The Department of State has also announced rewards of up to $2 million for information on CARR associates and up to $10 million for information related to NoName057(16).

Earlier this year, NoName and CARR launched a cyber attack on the sewage treatment plants in Poland. NoName057(16) was dismantled in July following an Europol-led crackdown on pro-Russian hacktivists striking NATO allies.

In other recent news, three Ukrainian hackers were arrested in Warsaw on charges of national defense threats.

Related

Former Employee of Cybersecurity Companies Charged in ALPHV (BlackCat) Ransomware Extortion Case

Bell Ambulance Breach Exposes Almost 240,000 Patients’ Data, Medusa Ransomware Claims Incident

2023 FBI Server Breach Exposed Epstein Investigation Files in an ‘Isolated Cyber Incident’

Stryker Cyberattack Wipes Employee Devices, Handala Claims Closing Almost 80 Offices Belonging to the US Medical Giant 

Cadence Bank Reaches $5.25 Million MOVEit Data Breach Settlement with Claims up to $10,000

Asus Routers Hijacked by KadNap Botnet for Malicious Proxies, Comprising Over 14,000 Devices

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.

Subscribe for Free

Please enter a valid email address.

Most Popular

Former Employee of Cybersecurity Companies Charged in ALPHV (BlackCat) Ransomware Extortion Case

Bell Ambulance Breach Exposes Almost 240,000 Patients’ Data, Medusa Ransomware Claims Incident

2023 FBI Server Breach Exposed Epstein Investigation Files in an ‘Isolated Cyber Incident’

Stryker Cyberattack Wipes Employee Devices, Handala Claims Closing Almost 80 Offices Belonging to the US Medical Giant 

Cadence Bank Reaches $5.25 Million MOVEit Data Breach Settlement with Claims up to $10,000

Asus Routers Hijacked by KadNap Botnet for Malicious Proxies, Comprising Over 14,000 Devices

Former Employee of Cybersecurity Companies Charged in ALPHV (BlackCat) Ransomware Extortion Case

Bell Ambulance Breach Exposes Almost 240,000 Patients’ Data, Medusa Ransomware Claims Incident

2023 FBI Server Breach Exposed Epstein Investigation Files in an ‘Isolated Cyber Incident’

Stryker Cyberattack Wipes Employee Devices, Handala Claims Closing Almost 80 Offices Belonging to the US Medical Giant 

Cadence Bank Reaches $5.25 Million MOVEit Data Breach Settlement with Claims up to $10,000

Asus Routers Hijacked by KadNap Botnet for Malicious Proxies, Comprising Over 14,000 Devices