On July 19, 2024, the U.S. Department of the Treasury announced sanctions against two identified members of the Russian, government‑aligned hacktivist group "Cyber Army of Russia Reborn" (CARR) for cyber operations targeting U.S. critical infrastructure. The Office of Foreign Assets Control (OFAC) designated Yuliya Vladimirovna Pankratova (aka YULIYA online), a Russian cybercriminal described as the leader of CARR, and Denis Olegovich Degtyarenko (aka Denis online), a Russian cybercriminal and primary hacker for CARR. Treasury characterizes CARR as a Russian hacktivist group that conducts low‑impact, unsophisticated distributed denial of service (DDoS) attacks and information operations in support of Russia, including against Ukraine since 2022, and later against U.S. and European critical infrastructure, leveraging industrial control system (ICS) access.

According to Treasury, CARR initially focused on DDoS attacks and posting stolen data from compromised websites in countries supporting Ukraine but later began conducting attacks on industrial control systems of multiple U.S. and European critical infrastructure entities. Treasury states that CARR uses "various unsophisticated techniques" and has manipulated industrial control systems and equipment at water supply, hydroelectric, wastewater, and energy facilities in the U.S. and Europe. In January 2024, CARR claimed responsibility for the overflow of water storage tanks in Abernathy and Muleshoe, Texas, which Treasury attributes to the manipulation of human‑machine interfaces at each facility via a public forum. Treasury reports that compromise of these industrial control systems resulted in the loss of tens of thousands of gallons of water. CARR is also said to have compromised supervisory control and data acquisition (SCADA) systems at a U.S. energy company, giving them control of alarms and pumps for tanks in that system. Treasury notes that despite CARR’s claimed control over these systems, major damage to victims has not occurred, which Treasury attributes to CARR’s lack of technical sophistication.

Treasury provides short biographical profiles. Pankratova, also known as YULIYA online, is described as Russian, the leader of CARR, and an individual who manages and controls CARR’s operations and has acted as a spokesperson for the group. Degtyarenko, also known as Denis online, is described as Russian, a primary hacker for CARR, and the individual behind compromise of the SCADA system of a U.S. energy company. In early May 2024, Degtyarenko allegedly advertised access to the compromised SCADA system on a cybercriminal forum, including exfiltrated programming materials on how to compromise SCADA systems, and sought to distribute the materials to external groups.

OFAC states it is designating Pankratova and Degtyarenko under Executive Order (E.O.) 13694, as amended, for being responsible for, complicit in, or having engaged in, directly or indirectly, cyber‑enabled activities originating from or conducted by persons located, in whole or in substantial part, outside the United States, that are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States, and that have the purpose or effect of harming or significantly compromising the provision of services by a computer or network of computers in support of an entity in a critical infrastructure sector.

Treasury outlines sanctions implications: as a result of OFAC’s action, all property and interests in property of the designated persons described that are in the United States or in the possession or control of U.S. persons are blocked, and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific OFAC license or exempt, all transactions by U.S. persons or within (or transiting) the United States that involve property or interests in property of the designated persons are prohibited. This includes the making of contributions or provision of funds, goods, or services by, to, or for the benefit of any designated person, or receipt of contributions or provision of funds, goods, or services from any such person. OFAC warns that financial institutions and other persons that engage in certain transactions or activities with sanctioned individuals may themselves be exposed to sanctions or be subject to enforcement action. The notice emphasizes that OFAC’s ultimate goal in sanctions is to bring about positive behavioral change, not to punish, and notes that OFAC will consider removing persons from the SDN List consistent with law and on the basis of changed behavior, de‑listing requests and related factors.

The press release situates these designations in a broader pattern of Treasury actions against Russia‑based cybercriminals: a May 7, 2024 designation of LockBit ransomware leader Dmitry Khoroshev (aka LockBitSupp); a February 20, 2024 designation of LockBit affiliates Ivan Kondratiev and Artur Sungatov; and a January 23, 2024 joint U.S., Australian, and U.K. action designating Alexander Ermakov for involvement in the 2022 ransomware attack on Australian private health insurer Medibank Private Limited. According to the U.S. Department of Justice, cited in the release, LockBit has targeted more than 2,500 victims worldwide and allegedly received over $500 million in ransom payments.

Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson is quoted in the release saying that CARR’s efforts to target U.S. critical infrastructure are an “unacceptable threat” to U.S. citizens and communities, and pledging that the United States will continue to use its full range of tools to hold accountable individuals engaged in malicious cyber activities. The release also links to OFAC’s Frequently Asked Question 897 for details on the process to submit a request for removal from an OFAC sanctions list and provides a general "Click here" link for more information on the individuals designated today.

On July 19, 2024, the U.S. Department of the Treasury announced sanctions against two identified members of the Russian, government‑aligned hacktivist group "Cyber Army of Russia Reborn" (CARR) for cyber operations targeting U.S. critical infrastructure. The Office of Foreign Assets Control (OFAC) designated Yuliya Vladimirovna Pankratova (aka YULIYA online), a Russian cybercriminal described as the leader of CARR, and Denis Olegovich Degtyarenko (aka Denis online), a Russian cybercriminal and primary hacker for CARR. Treasury characterizes CARR as a Russian hacktivist group that conducts low‑impact, unsophisticated distributed denial of service (DDoS) attacks and information operations in support of Russia, including against Ukraine since 2022, and later against U.S. and European critical infrastructure, leveraging industrial control system (ICS) access.

According to Treasury, CARR initially focused on DDoS attacks and posting stolen data from compromised websites in countries supporting Ukraine but later began conducting attacks on industrial control systems of multiple U.S. and European critical infrastructure entities. Treasury states that CARR uses "various unsophisticated techniques" and has manipulated industrial control systems and equipment at water supply, hydroelectric, wastewater, and energy facilities in the U.S. and Europe. In January 2024, CARR claimed responsibility for the overflow of water storage tanks in Abernathy and Muleshoe, Texas, which Treasury attributes to the manipulation of human‑machine interfaces at each facility via a public forum. Treasury reports that compromise of these industrial control systems resulted in the loss of tens of thousands of gallons of water. CARR is also said to have compromised supervisory control and data acquisition (SCADA) systems at a U.S. energy company, giving them control of alarms and pumps for tanks in that system. Treasury notes that despite CARR’s claimed control over these systems, major damage to victims has not occurred, which Treasury attributes to CARR’s lack of technical sophistication.

Treasury provides short biographical profiles. Pankratova, also known as YULIYA online, is described as Russian, the leader of CARR, and an individual who manages and controls CARR’s operations and has acted as a spokesperson for the group. Degtyarenko, also known as Denis online, is described as Russian, a primary hacker for CARR, and the individual behind compromise of the SCADA system of a U.S. energy company. In early May 2024, Degtyarenko allegedly advertised access to the compromised SCADA system on a cybercriminal forum, including exfiltrated programming materials on how to compromise SCADA systems, and sought to distribute the materials to external groups.

OFAC states it is designating Pankratova and Degtyarenko under Executive Order (E.O.) 13694, as amended, for being responsible for, complicit in, or having engaged in, directly or indirectly, cyber‑enabled activities originating from or conducted by persons located, in whole or in substantial part, outside the United States, that are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States, and that have the purpose or effect of harming or significantly compromising the provision of services by a computer or network of computers in support of an entity in a critical infrastructure sector.

Treasury outlines sanctions implications: as a result of OFAC’s action, all property and interests in property of the designated persons described that are in the United States or in the possession or control of U.S. persons are blocked, and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific OFAC license or exempt, all transactions by U.S. persons or within (or transiting) the United States that involve property or interests in property of the designated persons are prohibited. This includes the making of contributions or provision of funds, goods, or services by, to, or for the benefit of any designated person, or receipt of contributions or provision of funds, goods, or services from any such person. OFAC warns that financial institutions and other persons that engage in certain transactions or activities with sanctioned individuals may themselves be exposed to sanctions or be subject to enforcement action. The notice emphasizes that OFAC’s ultimate goal in sanctions is to bring about positive behavioral change, not to punish, and notes that OFAC will consider removing persons from the SDN List consistent with law and on the basis of changed behavior, de‑listing requests and related factors.

The press release situates these designations in a broader pattern of Treasury actions against Russia‑based cybercriminals: a May 7, 2024 designation of LockBit ransomware leader Dmitry Khoroshev (aka LockBitSupp); a February 20, 2024 designation of LockBit affiliates Ivan Kondratiev and Artur Sungatov; and a January 23, 2024 joint U.S., Australian, and U.K. action designating Alexander Ermakov for involvement in the 2022 ransomware attack on Australian private health insurer Medibank Private Limited. According to the U.S. Department of Justice, cited in the release, LockBit has targeted more than 2,500 victims worldwide and allegedly received over $500 million in ransom payments.

Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson is quoted in the release saying that CARR’s efforts to target U.S. critical infrastructure are an “unacceptable threat” to U.S. citizens and communities, and pledging that the United States will continue to use its full range of tools to hold accountable individuals engaged in malicious cyber activities. The release also links to OFAC’s Frequently Asked Question 897 for details on the process to submit a request for removal from an OFAC sanctions list and provides a general "Click here" link for more information on the individuals designated today.