Cyber Army of Russia Reborn
aka CARR, CyberArmyofRussia_Reborn
A pro-Russia hacktivist group that began with DDoS attacks and moved on to breaking into control screens at US and European water systems and farms. The US has sanctioned its leaders.
- Alert level
- 2/ 5
- Reports & advisories (90 days)
- 13
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Assessed that GRU Unit 74455 likely supported its creation — US CISA, FBI, NSA and international partners
- Sanctioned its leader and a primary member for attacks on US critical infrastructure — US Department of the Treasury
How they attack
Entry
Exposed remote-control screens
Like finding a factory control panel left unlocked by the roadside and fiddling with the knobs.
Goal
Flooding websites (DDoS)
Like a crowd blocking a shop's entrance so real customers cannot get in.
Goal
Tampering with equipment and bragging
Like turning the dials on a control panel, filming it, and boasting online that the damage was huge.
Recent articles
- Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
- Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
- DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
- Pillow: Quadratic GIF comment copying during save
- OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
- Russian hackers teamed up to wipe data at Ukrainian grain firm
- A2A Java SDK has a fail-open default task authorization
- ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily