U.S. State Department Rewards for Justice (RFJ) notice offering up to $2 million for information on individuals associated with the Russian-linked hacking group Cyber Army of Russia Reborn (CARR), also known as Z-Pentest. RFJ states that CARR operates under the direction or control of a foreign government and conducts malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. Industry reporting links CARR to the Main Centre for Special Technologies (GTsST) within the GRU (Main Directorate of the General Staff of the Armed Forces of the Russian Federation), and CARR members have publicly claimed ties to the Russian government.

According to RFJ, in late 2023 CARR began claiming responsibility for accessing industrial control systems (ICS) at multiple U.S. and European critical infrastructure targets. Using various techniques, the group has manipulated unsecured ICS at water supply, hydroelectric, wastewater, and energy facilities in the United States and Europe.

In the United States, CARR has claimed responsibility for numerous cyber incidents targeting water utilities in Indiana, New Jersey, and Texas. In one case, CARR actors caused minor disturbances at a water facility. In another town, their activity prompted officials to switch the water system to manual operations, which thwarted the group’s attempted access.

In January 2024, CARR actors posted a video on the group’s Telegram channel claiming credit for tampering with human machine interfaces (HMIs) at a U.S. water utility. The video allegedly shows a cyber actor manipulating interfaces controlling the utility’s operational technology assets.

In November 2024, CARR reportedly hacked a meat processing facility in Los Angeles County, California, spoiling thousands of pounds of meat and triggering an ammonia leak. The leak forced evacuation of the facility for several hours.

RFJ profiles key associated individuals. Yuliya Vladimirovna Pankratova (online alias "YUliYA", also linked to multiple other names) is described as the self-identified administrator of CARR, directing the group’s operations and acting as its spokesperson. Denis Olegovich Degtyarenko (online alias "Dena") is named as a primary hacker for CARR who accessed the SCADA system of a U.S. energy company. In early May 2024, Degtyarenko compiled basic training materials on how to access SCADA systems and was suspected of seeking to distribute these materials to external groups.

Another malicious cyber actor using the handle "Cyber_1ce_Killer" is identified as a CARR member; RFJ states that this moniker is associated with at least one GRU officer. RFJ notes that Pankratova and Degtyarenko were sanctioned by the U.S. Department of the Treasury in July 2024 for their roles in conducting cyber activities.

The profile lists associated locations as Russia and the United States of America, and associated organizations include APT44, FROZENBARENTS, GRU, GTsST, Information Operation Troops, Main Center for Special Technologies, Main Directorate of the General Staff of the Armed Forces of the Russian Federation, Sandworm, Seashell Blizzard, VIO, and Z-Pentest. Associated Telegram channels include CyberArmyofRussia_Reborn1, Z-Alliance, and Z-Pentest. The RFJ page calls for tips via a Tor-based channel and other platforms, emphasizing that the reward applies to individuals acting on behalf of foreign governments who engage in malicious cyber activity against U.S. critical infrastructure.

U.S. State Department Rewards for Justice (RFJ) notice offering up to $2 million for information on individuals associated with the Russian-linked hacking group Cyber Army of Russia Reborn (CARR), also known as Z-Pentest. RFJ states that CARR operates under the direction or control of a foreign government and conducts malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. Industry reporting links CARR to the Main Centre for Special Technologies (GTsST) within the GRU (Main Directorate of the General Staff of the Armed Forces of the Russian Federation), and CARR members have publicly claimed ties to the Russian government.

According to RFJ, in late 2023 CARR began claiming responsibility for accessing industrial control systems (ICS) at multiple U.S. and European critical infrastructure targets. Using various techniques, the group has manipulated unsecured ICS at water supply, hydroelectric, wastewater, and energy facilities in the United States and Europe.

In the United States, CARR has claimed responsibility for numerous cyber incidents targeting water utilities in Indiana, New Jersey, and Texas. In one case, CARR actors caused minor disturbances at a water facility. In another town, their activity prompted officials to switch the water system to manual operations, which thwarted the group’s attempted access.

In January 2024, CARR actors posted a video on the group’s Telegram channel claiming credit for tampering with human machine interfaces (HMIs) at a U.S. water utility. The video allegedly shows a cyber actor manipulating interfaces controlling the utility’s operational technology assets.

In November 2024, CARR reportedly hacked a meat processing facility in Los Angeles County, California, spoiling thousands of pounds of meat and triggering an ammonia leak. The leak forced evacuation of the facility for several hours.

RFJ profiles key associated individuals. Yuliya Vladimirovna Pankratova (online alias "YUliYA", also linked to multiple other names) is described as the self-identified administrator of CARR, directing the group’s operations and acting as its spokesperson. Denis Olegovich Degtyarenko (online alias "Dena") is named as a primary hacker for CARR who accessed the SCADA system of a U.S. energy company. In early May 2024, Degtyarenko compiled basic training materials on how to access SCADA systems and was suspected of seeking to distribute these materials to external groups.

Another malicious cyber actor using the handle "Cyber_1ce_Killer" is identified as a CARR member; RFJ states that this moniker is associated with at least one GRU officer. RFJ notes that Pankratova and Degtyarenko were sanctioned by the U.S. Department of the Treasury in July 2024 for their roles in conducting cyber activities.

The profile lists associated locations as Russia and the United States of America, and associated organizations include APT44, FROZENBARENTS, GRU, GTsST, Information Operation Troops, Main Center for Special Technologies, Main Directorate of the General Staff of the Armed Forces of the Russian Federation, Sandworm, Seashell Blizzard, VIO, and Z-Pentest. Associated Telegram channels include CyberArmyofRussia_Reborn1, Z-Alliance, and Z-Pentest. The RFJ page calls for tips via a Tor-based channel and other platforms, emphasizing that the reward applies to individuals acting on behalf of foreign governments who engage in malicious cyber activity against U.S. critical infrastructure.