Cyber Army of Russia

The Cyber Army of Russia, a threat actor believed to be linked to the notorious Sandworm group, has been active in carrying out malicious cyber activities since 2022. The group, also known as the Cyber Army of Russia Reborn (CARR), has been particularly involved in a series of low-impact distributed denial of service (DDoS) attacks against entities in Ukraine and other countries that have shown support for Ukraine. This group often collaborates with other pro-Russian hacker groups, such as NoName057(16), which was identified as the most active hacktivist threat actor during H1 2024. A significant development occurred when Ukraine's Security Service (SBU) managed to arrest a member of this pro-Russian hackers group. Despite this setback, the group continued its operations, including launching an attack against a wastewater treatment plant in the US in April 2024. Furthermore, the group claimed responsibility for DDoS attacks on the Telegram channel of the Cyber Army of Russia, citing Japan’s upcoming joint military exercise with the U.S. as motivation. In response to these escalating threats, the US government took action by sanctioning key members of the Cyber Army of Russia Reborn. Despite these measures, the group remains active, participating in campaigns involving major hacking groups like the pro-Islamic RipperSec. These collaborative efforts resulted in DDoS attacks against over 50 targets in France, further showcasing the persistent and global nature of the threat posed by the Cyber Army of Russia and its affiliates.