Federal officials have charged a Ukrainian national for allegedly supporting two Russia-linked cybercriminal groups responsible for dozens of attacks on critical infrastructure, including public drinking water systems in the United States. The indictments against Victoria Eduardovna Dubranova, 33, were unsealed December 9 in the U.S. District Court for the Central District of California.
Dubranova, also known as Vika, Tory, and SovaSonya, appeared in court the same day and was arraigned on a second indictment involving the group NoName057(16) (NoName). She pleaded not guilty in both cases. Trial is set to begin February 3, 2026, in the NoName matter and April 7, 2026, in the case involving CyberArmyofRussia_Reborn (CARR).
Dubranova was extradited to the United States earlier this year on charges related to CARR, also known as Z-Pentest. Federal authorities describe CARR as a group founded, funded, and directed by the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU) and linked to destructive cyberattacks worldwide.
The CARR indictment charges Dubranova with conspiracy to damage protected computers and tamper with public water systems, damaging protected computers, access device fraud, and aggravated identity theft. If convicted, she faces a statutory maximum sentence of 27 years in federal prison.
Dubranova was extradited to the United States earlier this year on charges related to CARR, also known as Z-Pentest
EPA Acting Assistant Administrator for Enforcement and Compliance Assurance Craig Pritzlaff said, “The defendant’s illegal actions to tamper with the nation’s public water systems put communities and the nation’s drinking water resources at risk… EPA is unwavering in its commitment to clean, safe water for all Americans.”
Assistant Attorney General for National Security John A. Eisenberg said, “Today’s actions demonstrate the Department’s commitment to disrupting malicious Russian cyber activity, whether conducted directly by state actors or their criminal proxies, aimed at furthering Russia’s geopolitical interests.”
First Assistant U.S. Attorney Bill Essayli for the Central District of California stated, “Politically-motivated hacktivist groups, whether state-sponsored like CARR or state-sanctioned like NoName, pose a serious threat to our national security.”
FBI Cyber Division Assistant Director Brett Leatherman added, “When pro-Russia hacktivist groups target our infrastructure, the FBI will use all available tools to expose their activity and hold them accountable.”
According to the indictment, CARR claimed credit for hundreds of cyberattacks supporting Russia’s geopolitical interests, including hacks of industrial control systems and distributed denial-of-service (DDoS) attacks. Victims allegedly included public drinking water systems across several U.S. states, resulting in damage to controls and the spilling of hundreds of thousands of gallons of drinking water. The group is also accused of attacking a Los Angeles meat processing facility in November 2024, spoiling thousands of pounds of meat and triggering an ammonia leak.
The law enforcement actions against CARR are part of Operation Red Circus, an FBI effort to disrupt Russian state-sponsored cyber threats. The State Department’s Rewards for Justice program announced a reward of up to $2 million for information on individuals associated with CARR, and the Treasury Department previously sanctioned two CARR members in July 2024.
The investigation was conducted by the EPA’s Criminal Investigation Division, the FBI’s Los Angeles Field Office, and the Department of Commerce’s Bureau of Industry and Security, with assistance from the Justice Department’s Office of International Affairs.
Authorities emphasized that an indictment is merely an allegation and that defendants are presumed innocent unless proven guilty.
