U.S. Department of Justice press release (Dec. 9, 2025) announcing actions against two Russian state‑sponsored cybercriminal hacking groups, CyberArmyofRussia_Reborn (CARR, also known as Z‑Pentest) and NoName057(16) (NoName). A Ukrainian national, Victoria Eduardovna Dubranova (33), a.k.a. Vika, Tory, and SovaSonya, was indicted in the Central District of California for her role in destructive cyberattacks worldwide that supported Russia’s geopolitical interests. She had previously been extradited to the United States on an indictment related to CARR and was arraigned on a second indictment tied to NoName; she pleaded not guilty in both cases. The CARR indictment alleges that the group was founded, funded, and directed by Russia’s GRU, carried out hundreds of cyberattacks globally (including against U.S. critical infrastructure such as public drinking water systems, a meat processing facility in Los Angeles, U.S. election infrastructure, and U.S. nuclear regulatory websites), and used GRU‑financed cybercriminal services (DDoS‑for‑hire). CARR attacks allegedly damaged industrial control systems, caused spills of hundreds of thousands of gallons of drinking water across several U.S. states, spoiled thousands of pounds of meat, and triggered an ammonia leak in November 2024 at a Los Angeles meat processing plant. CARR also allegedly had over 100 members at times and more than 75,000 Telegram followers; tasking guidance and financing were provided by a GRU‑associated operator using the moniker "Cyber_1ce_Killer." Dubranova is charged in the CARR case with conspiracy to damage protected computers and tamper with public water systems, damaging protected computers, access device fraud, and aggravated identity theft; the statutory maximum penalty is 27 years in federal prison. The separate NoName indictment alleges that NoName is a covert, state‑sanctioned project administered in part by employees of The Center for the Study and Network Monitoring of the Youth Environment (CISM), an IT organization created by order of the President of Russia in October 2018. NoName allegedly conducted hundreds of DDoS attacks worldwide, targeting government agencies, financial institutions, and critical infrastructure such as public railways and ports, using its proprietary DDoS tool DDoSia and a global network infrastructure built by CISM employees. NoName is described as recruiting volunteers worldwide to download DDoSia, using their computers to execute attacks chosen by NoName leadership, and incentivizing participation by publishing a daily leaderboard on its Telegram channel and paying top volunteers in cryptocurrency. Dubranova is charged in the NoName case with conspiracy to damage protected computers, with a statutory maximum penalty of five years in prison. Senior U.S. officials characterize these groups as pro‑Russia, politically motivated hacktivists—either state‑sponsored (CARR) or state‑sanctioned (NoName)—and warn that their activities threaten U.S. national security by targeting critical infrastructure and NATO/U.S. interests abroad. Concurrent measures include U.S. State Department Rewards for Justice offers (up to $2 million for information on CARR/Z‑Pentest members and up to $10 million for information on NoName members) and a joint cybersecurity advisory issued by the FBI, CISA, NSA, DOE, EPA, and DC3, assessing that pro‑Russia hacktivist groups like CARR and NoName target minimally secured, internet‑facing virtual network computing (VNC) connections to infiltrate operational technology (OT) control devices in critical infrastructure systems, leading to varying impact up to physical damage. The release also references prior OFAC sanctions (July 19, 2024) on CARR leader Yuliya Vladimirovna Pankratova and primary hacker Denis Olegovich Degtyarenko for cyber operations against U.S. critical infrastructure, and notes that the FBI Los Angeles Field Office investigated these matters as part of Operation Red Circus, an ongoing effort to disrupt Russian state‑sponsored cyberthreats to U.S. critical infrastructure and interests abroad. The DOJ emphasizes that the indictments are allegations and that all defendants are presumed innocent until proven guilty.

U.S. Department of Justice press release (Dec. 9, 2025) announcing actions against two Russian state‑sponsored cybercriminal hacking groups, CyberArmyofRussia_Reborn (CARR, also known as Z‑Pentest) and NoName057(16) (NoName). A Ukrainian national, Victoria Eduardovna Dubranova (33), a.k.a. Vika, Tory, and SovaSonya, was indicted in the Central District of California for her role in destructive cyberattacks worldwide that supported Russia’s geopolitical interests. She had previously been extradited to the United States on an indictment related to CARR and was arraigned on a second indictment tied to NoName; she pleaded not guilty in both cases. The CARR indictment alleges that the group was founded, funded, and directed by Russia’s GRU, carried out hundreds of cyberattacks globally (including against U.S. critical infrastructure such as public drinking water systems, a meat processing facility in Los Angeles, U.S. election infrastructure, and U.S. nuclear regulatory websites), and used GRU‑financed cybercriminal services (DDoS‑for‑hire). CARR attacks allegedly damaged industrial control systems, caused spills of hundreds of thousands of gallons of drinking water across several U.S. states, spoiled thousands of pounds of meat, and triggered an ammonia leak in November 2024 at a Los Angeles meat processing plant. CARR also allegedly had over 100 members at times and more than 75,000 Telegram followers; tasking guidance and financing were provided by a GRU‑associated operator using the moniker "Cyber_1ce_Killer." Dubranova is charged in the CARR case with conspiracy to damage protected computers and tamper with public water systems, damaging protected computers, access device fraud, and aggravated identity theft; the statutory maximum penalty is 27 years in federal prison. The separate NoName indictment alleges that NoName is a covert, state‑sanctioned project administered in part by employees of The Center for the Study and Network Monitoring of the Youth Environment (CISM), an IT organization created by order of the President of Russia in October 2018. NoName allegedly conducted hundreds of DDoS attacks worldwide, targeting government agencies, financial institutions, and critical infrastructure such as public railways and ports, using its proprietary DDoS tool DDoSia and a global network infrastructure built by CISM employees. NoName is described as recruiting volunteers worldwide to download DDoSia, using their computers to execute attacks chosen by NoName leadership, and incentivizing participation by publishing a daily leaderboard on its Telegram channel and paying top volunteers in cryptocurrency. Dubranova is charged in the NoName case with conspiracy to damage protected computers, with a statutory maximum penalty of five years in prison. Senior U.S. officials characterize these groups as pro‑Russia, politically motivated hacktivists—either state‑sponsored (CARR) or state‑sanctioned (NoName)—and warn that their activities threaten U.S. national security by targeting critical infrastructure and NATO/U.S. interests abroad. Concurrent measures include U.S. State Department Rewards for Justice offers (up to $2 million for information on CARR/Z‑Pentest members and up to $10 million for information on NoName members) and a joint cybersecurity advisory issued by the FBI, CISA, NSA, DOE, EPA, and DC3, assessing that pro‑Russia hacktivist groups like CARR and NoName target minimally secured, internet‑facing virtual network computing (VNC) connections to infiltrate operational technology (OT) control devices in critical infrastructure systems, leading to varying impact up to physical damage. The release also references prior OFAC sanctions (July 19, 2024) on CARR leader Yuliya Vladimirovna Pankratova and primary hacker Denis Olegovich Degtyarenko for cyber operations against U.S. critical infrastructure, and notes that the FBI Los Angeles Field Office investigated these matters as part of Operation Red Circus, an ongoing effort to disrupt Russian state‑sponsored cyberthreats to U.S. critical infrastructure and interests abroad. The DOJ emphasizes that the indictments are allegations and that all defendants are presumed innocent until proven guilty.