Home

Blog

Cyber Army of Russia Reborn Hacktivist Group

Arun KL

February 27, 2025

10m

Cyber Army of Russia Reborn Hacktivist Group

Threats

Digital illustration of a fierce bear with glowing eyes surrounded by industrial machinery and Cyrillic text.

The Cyber Army of Russia Reborn (CARR), also known as the Cyber Army of Russia, is a pro-Russian hacktivist group that has emerged as a significant threat actor in the ongoing cyber conflict linked to the Russia-Ukraine war. While presenting itself as a hacktivist collective, evidence suggests potential links to Russian state-sponsored groups, raising concerns about its true nature and objectives. CARR has gained notoriety for its attacks on critical infrastructure, particularly water utilities and hydroelectric facilities, in countries supporting Ukraine, including the United States, Poland, and France. This article provides a deep dive into CARR's origins, tactics, targets, campaigns, and defensive strategies, offering security professionals crucial insights to combat this evolving threat.

Origins & Evolution

The Cyber Army of Russia Reborn first appeared in early 2022, coinciding with the start of the Russian invasion of Ukraine. Initial activities focused on Distributed Denial of Service (DDoS) attacks against Ukrainian entities and countries providing support to Ukraine. By late 2023, the group shifted its focus, targeting critical infrastructure in the US and Europe, marking a significant escalation in its operational scope and potential impact.

The group's name itself suggests a revival or rebranding of a previous entity. While a direct lineage is difficult to confirm, the "Cyber Army of Russia" moniker has been used intermittently in the past, often associated with pro-Russian hacktivist activity. This current iteration, "Reborn," implies a renewed effort with potentially enhanced capabilities.

There is strong suspicion, though not definitive proof, of links between CARR and Russian state-sponsored Advanced Persistent Threat (APT) groups, most notably Sandworm (also known as APT44, and believed to be Unit 74455 of Russia's GRU military intelligence). Cybersecurity firm Mandiant has reported evidence of operational overlap, including instances of data stolen by Sandworm being leaked by CARR. This could indicate several possibilities:

Direct Control: CARR could be a directly controlled subunit or cover persona for Sandworm, used to conduct attacks that Russia wants to avoid direct attribution for.
Collaboration: CARR could be a separate, ideologically aligned group that receives tasking, tools, or intelligence from Sandworm.
Loose Affiliation: CARR could be inspired by Sandworm, mimicking their tactics and targeting, but operating independently.

The exact nature of the relationship remains unclear, but the Sandworm connection significantly elevates the potential threat level of CARR, given Sandworm's history of destructive attacks, including the NotPetya ransomware and attacks on Ukrainian power grids. The US Treasury Department sanctions imposed on two key CARR members, Yuliya Vladimirovna Pankratova (leader, alias YUliYA) and Denis Olegovich Degtyarenko (primary hacker, alias Dena), further underscore the seriousness with which the group is viewed.

Tactics & Techniques

CARR employs a range of tactics, techniques, and procedures (TTPs), evolving from basic DDoS attacks to more sophisticated intrusions targeting operational technology (OT) systems.

Distributed Denial of Service (DDoS) Attacks: Initially, and still a significant part of their arsenal, CARR utilizes DDoS attacks to overwhelm targeted websites and services, causing disruption and making them unavailable to legitimate users. They have developed their own DDoS tool, reportedly based on the Aura-DDoS code used by Killnet, another pro-Russian hacktivist group. This tool is designed to be multi-platform (Microsoft, Linux, Android) and can reportedly bypass Cloudflare protections. To mitigate such attacks, using the right DDoS protection tools is essential.
Operational Technology (OT) Intrusions: This is the most concerning aspect of CARR's evolution. They have demonstrated the ability to gain access to and manipulate Human-Machine Interfaces (HMIs) – the software used to control physical processes in industrial control systems (ICS). This allows them to directly impact operations at critical infrastructure facilities.
Data Exfiltration and Leakage: CARR has been observed leaking stolen data, often obtained through collaborations with other groups or potentially provided by state-sponsored actors like Sandworm. This stolen information is used for propaganda purposes, to exert pressure on targets, or to embarrass them publicly. Several data breaches have been reported recently, and it's crucial to stay informed about such incidents.
Social Engineering: While not extensively documented, the group likely employs social engineering tactics to gain initial access to target networks. This could involve phishing emails, impersonation, or other methods to trick individuals into providing credentials or installing malware. A common type of attack is spear phishing which has been widely used.
Telegram Usage: CARR heavily relies on Telegram for communication, coordination, recruitment, and propaganda. They use Telegram channels to announce attacks, share stolen data, and disseminate pro-Russian narratives. This reliance on Telegram is common among hacktivist groups, providing a degree of anonymity and a platform for reaching a wide audience.
Vulnerability Exploitation: Although often using unsophisticated techniques, they can get access using known, and public vulnerabilities. Protecting against these exploits requires a robust vulnerability assessments strategy.

The shift towards OT intrusions is particularly significant. While CARR's technical capabilities in this area are described as "unsophisticated" in some reports, the fact that they are able to gain access to and manipulate HMIs demonstrates a clear intent to cause physical disruption. This raises concerns about the potential for more damaging attacks in the future, particularly if they gain access to more advanced tools or expertise.

Targets or Victimology

CARR's targeting is directly linked to the Russia-Ukraine conflict and Russia's broader geopolitical objectives. Their targets primarily include:

Ukraine and Supporting Countries: Initially, the group focused on Ukrainian government websites, critical infrastructure, and media outlets. They have also consistently targeted countries providing military or financial aid to Ukraine, including NATO members.
Critical Infrastructure: This is the most significant aspect of their targeting strategy. CARR has specifically targeted water utilities, hydroelectric facilities, and wastewater treatment plants in the US, Poland, and France. This focus on critical infrastructure is intended to cause disruption, sow fear, and potentially retaliate against countries perceived as adversaries. Securing IoT devices is also important to prevent attacks.
Government Entities: Government websites and networks are frequent targets, likely for both disruption and espionage purposes.
Private Companies: While less frequent, private companies, particularly those involved in critical infrastructure or supporting Ukraine, can also be targeted.

The choice of critical infrastructure, particularly water utilities, is noteworthy. These systems are often under-resourced and have weaker security than other critical sectors, making them "low-hanging fruit" for attackers. The attacks also have a strong psychological impact, as they directly affect essential services and can create public anxiety.

Attack Campaigns

Several notable attack campaigns have been attributed to CARR, demonstrating their evolving tactics and increasing threat:

Early 2022 - DDoS Attacks: Focused primarily on DDoS attacks against Ukrainian and allied government websites and online services.
Late 2023 - Texas Water Utilities: Targeted water utilities in Abernathy and Muleshoe, Texas, resulting in a water tank overflow in Muleshoe. CARR posted videos on Telegram showing them manipulating HMIs. Utilities in Abernathy and Hale Center were also impacted.
Late 2023 - Polish Wastewater Treatment Plant: Targeted a wastewater treatment plant in Wydminy, Poland, demonstrating their expansion beyond US targets.
Early 2024 - French Hydroelectric Facility: Claimed to have targeted the Courlon Sur Yonne hydroelectric dam in France. However, it was later determined they had actually accessed a smaller, less significant water mill. This attack coincided with French President Macron's statements about potentially sending troops to Ukraine, suggesting a retaliatory motive.
Ongoing 2024 - Continued Infrastructure attacks: Increasing number of attacks at critical infrastructure.

These campaigns highlight the group's growing focus on critical infrastructure and their willingness to directly manipulate OT systems. While the actual damage caused in some of these incidents has been limited, the potential for more significant disruption is clear. Supply chain attacks can also be used for compromising.

Defenses

Protecting against CARR and similar hacktivist groups requires a multi-layered approach, combining technical defenses with proactive threat intelligence and incident response planning:

Network Segmentation: Isolate critical OT networks from IT networks to limit the impact of any potential intrusion. Implement strict access controls and network monitoring to detect and prevent lateral movement.
Vulnerability Management: Regularly scan for and patch vulnerabilities in both IT and OT systems. Prioritize patching of known vulnerabilities that are actively exploited by threat actors. Pay particular attention to remote access vulnerabilities and weak authentication mechanisms.
Multi-Factor Authentication (MFA): Implement MFA for all remote access to critical systems, including OT networks. This adds an extra layer of security and makes it more difficult for attackers to gain access even if they obtain valid credentials.
Security Awareness Training: Train employees, particularly those with access to critical systems, to recognize and avoid phishing attacks and other social engineering tactics. Regularly conduct simulated phishing exercises to test employee awareness.
Intrusion Detection and Prevention Systems (IDPS): Deploy and maintain IDPS on both IT and OT networks to detect and block malicious activity. Configure these systems to monitor for known indicators of compromise (IOCs) associated with CARR and other relevant threat actors.
Endpoint Detection and Response (EDR): Implement EDR solutions on endpoints to detect and respond to malicious activity that may bypass traditional security controls.
Threat Intelligence: Leverage threat intelligence feeds and platforms to stay informed about the latest TTPs and IOCs associated with CARR and other relevant threat actors. This information can be used to proactively adjust security controls and improve detection capabilities.
Incident Response Plan: Implement, and test an incident response plan.
DDoS Mitigation: Implement DDoS mitigation strategies, such as using a content delivery network (CDN) or specialized DDoS protection services, to protect against volumetric attacks.
Specific OT Security Measures:

* Restrict Connections per IP: Limit the number of connections allowed from a single IP address to OT systems.

* Set Connection Limits per Second: Implement rate limiting to prevent rapid connections that could indicate an attack.

* Limit Downloads from a Single IP: Restrict the amount of data that can be downloaded from a single IP address to prevent data exfiltration.

* Block Non-Standard User-Agent Headers: Block HTTP requests with unusual or non-standard User-Agent headers, which can be indicative of automated tools.

* Implement CAPTCHAs: Use CAPTCHAs to distinguish between human users and bots, particularly for access to critical systems.

* Monitor Database Request Patterns: Monitor database requests for unusual patterns, such as large-scale data retrieval or attempts to modify critical settings.

Conclusion

The Cyber Army of Russia Reborn represents a significant and evolving threat, particularly to critical infrastructure. While currently characterized by relatively unsophisticated techniques, their demonstrated ability to access and manipulate OT systems, coupled with potential links to more capable state-sponsored actors like Sandworm, makes them a serious concern. Their actions are directly tied to the ongoing geopolitical conflict and serve as a reminder of the increasing role of cyber operations in modern warfare. Organizations, especially those operating critical infrastructure, must prioritize cybersecurity and implement robust defenses to mitigate the risk posed by CARR and similar groups. Proactive threat intelligence, vulnerability management, network segmentation, and a well-defined incident response plan are crucial for protecting against this growing threat. The blurring lines between hacktivism and state-sponsored activity make attribution and response challenging, highlighting the need for international cooperation and information sharing to effectively counter these threats. It's also important to have security logging and monitoring to detect any suspicious activities.

Found this article interesting? Keep visit thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive tips like this.

You may also like these articles:

Arun KL

Arun KL is a cybersecurity professional with 15+ years of experience in IT infrastructure, cloud security, vulnerability management, Penetration Testing, security operations, and incident response. He is adept at designing and implementing robust security solutions to safeguard systems and data. Arun holds multiple industry certifications including CCNA, CCNA Security, RHCE, CEH, and AWS Security.

Home

About TheSecMaster

Blog

Tools

Learn

Subscribe

Subscribe

Advertise with us

Cyber Army of Russia Reborn Hacktivist Group

Table of Contents

Cyber Army of Russia Reborn Hacktivist Group

Origins & Evolution

Tactics & Techniques

Targets or Victimology

Attack Campaigns

Defenses

Conclusion

Arun KL