Carr

Threat Actor updated a year ago (2024-11-29T14:53:23.582Z)
Download STIX
Preview STIX
The Cyber Army of Russia Reborn (CARR), a threat actor group, has been involved in a series of cyber-attacks against critical infrastructure since 2022. The group targeted entities in Ukraine and other countries that supported Ukraine with low-impact DDoS attacks. CARR's most notable actions include the compromise of industrial control systems across the U.S. and Europe in late 2023, affecting water, hydroelectric, wastewater, and energy facilities. In January 2024, they claimed responsibility for causing overflows of water storage tanks in Abernathy and Muleshoe, Texas, and compromised a U.S. energy company's SCADA system. Despite gaining temporary control, their limited hacking capabilities prevented major damage. In April 2022, cybersecurity expert Jeff Carr revealed that GURMO, the Main Directorate of Intelligence at the Ministry of Defense of Ukraine, had been conducting computer network operations against Gazprom. CARR released detailed information about these attacks, including samples of documents taken by GURMO’s cyber team. The stolen data included administrative files, communication requirements, maps, construction requirements for a new pipeline facility, work orders, and more. However, Gazprom is unlikely to acknowledge the breach or the successful attacks on its SCADA systems. In an unrelated incident, Labyron Carr and his nonprofit Cappin4Capo Inc., founded in 2017 after his son was killed by gun violence, alleged that Instagram’s parent company, Meta Platforms, repeatedly blocked them from accessing their social media profile after it was hacked in September. Despite several attempts, Instagram did not grant Carr access after the hack, leading to a lawsuit represented by Irwin IP LLC. The case is known as Carr v. Meta Platforms, Inc., N.D. Ill., No.
Description last updated: 2024-10-17T12:52:38.044Z
What's your take? (Question 1 of 4)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
Cyber Army of Russia is a possible alias for Carr. The Cyber Army of Russia, a threat actor believed to be linked to the notorious Sandworm group, has been active in carrying out malicious cyber activities since 2022. The group, also known as the Cyber Army of Russia Reborn (CARR), has been particularly involved in a series of low-impact distributed
3
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Hacktivist
Ddos
VNC
Russia
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.