Z-Pentest: the Russian hacker group led by Gru behind the attacks on industrial systems in Europe and the US

The investigation is being conducted by the US Attorney’s Office for the Central District of California. On 9 December 2025, two indictments against Victoria Eduardovna Dubranova, a Ukrainian national extradited to the United States and accused of having first participated in the activities of Z-Pentest and subsequently in those of NoName057(16). 

However, it is the account contained in the court documents that describes the relationship between Z-Pentest and Moscow. The group is said to have claimed responsibility for hundreds of attacks worldwide in support of Russian geopolitical interests, focusing in particular on industrial control systems and DDoS (Distributed Denial of Service) attacks: the flooding of a system with requests used to render an online service inaccessible.

In the United States, Z-Pentest is reported to have compromised drinking water facilities, causing damage to control systems and the spillage of hundreds of thousands of gallons of water. In November 2024, it is also reported to have targeted a meat-processing plant in Los Angeles, causing thousands of pounds of produce to spoil and an ammonia leak.

But the most significant finding of the investigation concerns the chain of command. According to the documents, an individual using the name Cyber_1ce_Killer, linked to at least one GRU officer, instructed the leadership of Z-Pentest on which categories of victims to target. The organisation is also said to have funded the group’s access to criminal services used to carry out the attacks.

So it is not merely a matter of political affinity. Nor is it simply a case of hackers acting independently on Moscow’s behalf. The US Department of Justice’s account describes funding, guidance on targets and direction traceable to Russian military intelligence.

NoName057(16) also features in the same proceedings, but with a different structure. US investigators describe it as a project authorised by the Russian state, administered in part through an IT organisation established in 2018 on the orders of the President of the Russian Federation. As for Z-Pentest,, however, the attribution set out in the indictment is even more direct: its foundation, funding and management are traced back to the GRU.

The Z-Pentest case sheds light on a much broader system. Russia, more than any other country, illustrates just how wide the gap can become between state institutions and groups that share their objectives.

Globally, it was reported, there are 118 hacker groups targeting the West. According to European intelligence, the Russian network is the most organised. It operates on multiple levels. The collectives Apt28/Fancy Bear and Sandworm/Apt44 – together with Z-Pentest – are linked to the GRU, the military intelligence service: the former operates primarily in political and military espionage, whilst the latter is also involved in sabotage and attacks on critical infrastructure. Apt29/Midnight Blizzard, on the other hand, is linked to the SVR, the foreign intelligence service, whilst Turla and Star Blizzard are associated with the FSB, the Federal Security Service.

The pro-Russian network then operates around these organisations. Alongside them are NoName Killnet, UserSec, People’s CyberArmy and XakNet, key players in campaigns against Ukraine, NATO countries and Western governments. However, a chain of command linking them to Moscow has not been proven in all cases: some work for the intelligence services, others receive support, and others independently share their objectives.

The Chinese model is less exposed. Apt31 is linked by the US Department of Justice to a programme run by the Ministry of State Security, Beijing’s main civilian intelligence service. Volt Typhoon targets critical infrastructure, Salt Typhoon targets telecommunications; Apt40 and Apt41 are associated with espionage campaigns.

North Korea is even more centralised. Lazarus, BlueNoroff and Andariel are considered by the United States to be controlled by the Reconnaissance General Bureau, Pyongyang’s military intelligence service; Kimsuky operates primarily in the field of political and strategic espionage.