Z-Pentest: the Russian hacker group led by GRU behind the attacks on European and US industrial systems

There are 118 actors that populate the global galaxy of the cyber threat against the West. But behind acronyms, nicknames and claims, very different realities coexist: on the one hand the hacktivists, collectives who act out of ideological affinity and share the geopolitical objectives of a country; on the other hand, groups that depend directly on the state apparatus receive funds, indications and operational directives. It is in the Russian galaxy that the border becomes thinner. There are Moscow intelligence hackers, there are pro-Russian collectives who share objectives and enemies. And then there are groups that present themselves as hacktivists, but have the State directly behind them.

This is the case of Z-Pentest - the actor who together with NoName057(16) claimed responsibility for the attacks on European supermarket refrigerators. According to the US Department of Justice, Z-Pentest - also known as Cyber ​​Army of Russia Reborn - was "founded, financed and directed" by GRU, Russian military intelligence. Hacktivism, in this case, becomes cover.

To understand the weight of this trace, we need to go back to October 12, in France, when a hacker action sent the industrial refrigerators of hundreds of points of sale connected to chains such as Carrefour, E. Leclerc, Intermarché and Coopérative U into disarray. In the following three weeks the same attacks also reached Italy, Belgium, the Netherlands, Portugal and other European countries. The claim comes with a video from NoName, which attributes the operation to an action carried out together with Z-Pentest. Suspicions of a Moscow hand are flatly rejected. Kremlin spokesman Dmitry Peskov speaks of "absurd claims without arguments or evidence". But the trail, at this point, takes a very precise direction: one of the groups that claim responsibility for the attacks is indicated by American documents as directly linked to Russian military intelligence.

Il Sole 24 Ore was able to consult a dossier from the US Department of Justice in proceedings against Z-Pentest.

The collective is not considered by investigators to be a simple group of pro-Russian hacktivist hackers. According to the US indictment, it was "founded, financed and directed" by the GRU, the Main Directorate of the General Staff of the Russian Armed Forces, i.e. Moscow's military intelligence service.