Z-Pentest: Russian GRU-Directed Hacker Group Targeting Western Industrial Systems
US court documents reveal the military intelligence agency's direct control over cyber sabotage operations.
1State-Directed Cyber Sabotage
The hacking group Z-Pentest, also known as Cyber Army of Russia Reborn, is not a mere hacktivist collective. US Department of Justice documents reveal the group was founded, financed, and directly commanded by the GRU, Russia’s military intelligence agency. This structure blurs the lines between independent cyber actors and state-sponsored warfare.
2Targeting Critical Infrastructure
Z-Pentest has conducted hundreds of attacks against Western industrial control systems. In the United States, the group compromised potable water facilities, causing significant water loss. Additionally, a November 2024 attack on a Los Angeles meat processing plant resulted in thousands of pounds of spoiled product and a dangerous ammonia leak.
3European Supermarket Disruptions
In October 2024, Z-Pentest and NoName057(16) launched a coordinated campaign targeting industrial refrigerators across Europe. The attacks disrupted operations at major retail chains including Carrefour, E. Leclerc, and Intermarché. The campaign expanded over three weeks, impacting infrastructure in Italy, Belgium, the Netherlands, and Portugal, despite Kremlin denials of state involvement.
4The GRU Command Chain
Evidence from the US Federal District Court in Los Angeles highlights a direct chain of command. An operative using the alias Cyber_1ce_Killer, linked to a GRU officer, provided the group with specific target categories. The Russian military intelligence agency also funded the group's access to criminal services used for these cyber operations.
5Legal Proceedings in California
The investigation is led by the Federal Prosecutor’s Office of the Central District of California. On December 9, 2025, the court unsealed indictments against Victoria Eduardovna Dubranova, a Ukrainian citizen extradited to the US. She is accused of participating in the activities of both Z-Pentest and the affiliated group NoName057(16) under Russian direction.
6Distinguishing Hacktivism from Intelligence
While the global cyber threat landscape includes 118 distinct actors, the Russian model is uniquely organized. Unlike purely ideological hacktivists, groups like Z-Pentest receive operational directives and financial support from state apparatuses. This hybrid model allows Moscow to maintain plausible deniability while conducting sophisticated sabotage against critical infrastructure in NATO-aligned nations.
7Broader Russian Cyber Ecosystem
The Russian intelligence apparatus utilizes various specialized groups for different objectives. While the GRU manages Z-Pentest, Sandworm, and Fancy Bear for sabotage and espionage, the SVR oversees Midnight Blizzard, and the FSB directs Turla and Star Blizzard. This multi-layered strategy ensures comprehensive coverage of political, military, and critical infrastructure targets globally.
8Global State-Sponsored Patterns
The Russian approach mirrors centralized cyber strategies seen elsewhere. China utilizes programs like the Ministry of State Security to manage groups such as Apt31 and Volt Typhoon, while North Korea’s Lazarus and Andariel are controlled by the Reconnaissance General Bureau. These state-controlled entities represent a significant escalation in modern geopolitical conflict.