U.S. takes a Ukrainian hacker to court over Russia-backed attacks on water and food systems

Overview

Updated May 10

A 33-year-old Ukrainian woman now sits at the center of Washington's latest cyber drama. U.S. prosecutors say Victoria Dubranova helped two Russia-backed hacker crews hit water systems, food facilities, and other infrastructure, turning online "hacktivism" into covert state work.

Her twin indictments link real-world damage (overflowing water tanks, spoiled meat, disrupted services) to Russian money and direction.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

27 years

Maximum CARR-case sentence

Statutory maximum prison time Dubranova faces on the CARR indictment alone.

5 years

Maximum NoName sentence

Additional maximum penalty on the separate NoName057(16) conspiracy charge.

$10M

Top reward on offer

State Department reward for information on NoName co‑conspirators; $2M for CARR.

100+ servers

NoName infrastructure seized

Servers disrupted worldwide in July 2025 takedown linked to Operation Eastwood/Red Circus.

2 groups

Hacktivist outfits in indictments

CyberArmyofRussia_Reborn and NoName057(16) both tied to Russian state backing.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

People Involved

Victoria Eduardovna Dubranova

Accused facilitator for Russian-backed hacktivist groups CARR and NoName057(16)

In U.S. custody in Los Angeles, pleaded not guilty; trials set for 2026

Bill Essayli

First Assistant U.S. Attorney, Central District of California

Leading messaging on Dubranova prosecutions and broader Russian cyber threat crackdown

John A. Eisenberg

Assistant Attorney General for National Security

Overseeing DOJ’s strategy against Russian state-sponsored cyber operations

Yuliya Vladimirovna Pankratova

Alleged leader of CyberArmyofRussia_Reborn (CARR)

Sanctioned by U.S. Treasury; believed to remain in Russia, out of U.S. reach

Organizations Involved

CyberArmyofRussia_Reborn (CARR)

Pro-Russian hacktivist group

Allegedly founded, funded, and directed by Russia’s GRU; subject of U.S. charges and sanctions

CARR is a Russian-aligned hacker crew accused of moving from nuisance DDoS attacks to physically risky intrusions on water and food infrastructure.

NoName057(16)

Pro-Russian hacktivist group

Target of U.S. indictment and multinational takedown; infrastructure disrupted but group still active online

NoName057(16) runs large-scale DDoS campaigns using its DDOSIA tool, gamifying attacks on NATO-aligned targets.

U.S. Department of Justice

Federal agency

Bringing criminal cases against Dubranova and coordinating broader actions against Russian cyber actors

DOJ is turning a patchwork of Russian cyber incidents into a coordinated legal and diplomatic campaign.

Federal Bureau of Investigation – Operation Red Circus

Federal Law Enforcement Operation

Ongoing FBI effort to disrupt Russian state-sponsored cyberthreats to U.S. critical infrastructure

Operation Red Circus is the FBI’s umbrella campaign targeting Russian-backed hacktivist and cyber units hitting U.S. infrastructure.

Timeline

March 2022 December 2025

6 events Latest: December 10th, 2025 · 9 months ago

Tap a bar to jump to that date

December 2025
Reuters coverage turns Dubranova case into global story
Latest Media

Reuters story spotlights Dubranova case, framing it as part of broader Russian cyber campaign.
December 10th, 2025
Dubranova indictments unsealed in Los Angeles federal court
Legal

Los Angeles court unseals two indictments charging Dubranova over CARR and NoName cyberattacks.
December 9th, 2025
U.S. posts multimillion-dollar rewards and warns utilities
Policy / Advisory

State Department posts rewards for CARR, NoName leaders as agencies warn utilities about VNC exposures.
December 9th, 2025
July 2025
Operation Eastwood hits NoName057(16) infrastructure across 13 countries
Enforcement

Europol and partners seize more than 100 servers tied to NoName DDoS network.
July 16th, 2025
July 2024
Treasury sanctions CARR leaders after U.S. water system hacks
Sanctions

Treasury sanctions CARR leader and primary hacker after claimed attacks on U.S. water utilities.
July 19th, 2024
March 2022
DOJ charges Russian officials over historical critical-infrastructure hacks
Legal

Justice Department unseals charges against four Russian officials for historic hacks on global energy systems.
March 24th, 2022

Scenarios

Dubranova Convicted in Landmark Critical-Infrastructure Hacking Trial

Likely

Discussed by: Legal commentators and national-security lawyers drawing on past DOJ nation-state hacking cases

If prosecutors can clearly tie Dubranova’s actions to physical damage—overflowing water tanks, spoiled meat, disrupted services—and show financial or tasking links back to Russian entities, a jury conviction is likely. That outcome would cement the CARR and NoName cases as precedents for treating state-aligned “hacktivists” like traditional spies or saboteurs. Expect heavy sentences, more unsealed indictments against Russian-based operators, and pressure on allies to criminally charge their own NoName and CARR members.

Plea Deal Trades Prison Time for Intelligence on Russian Cyber Networks

Possible

Discussed by: Former prosecutors and cyber policy analysts speculating on DOJ strategy in major cyber cases

Dubranova is a rare thing for U.S. authorities: a suspected insider from Russian-aligned hacker circles sitting in an American jail. DOJ could offer a plea that cuts her exposure in exchange for cooperation on CARR, NoName, GRU handlers, and money flows. That would accelerate follow‑on indictments and sanctions, but could fuel Russian propaganda portraying her as coerced. U.S. officials would have to show the deal produced concrete takedowns, not just colorful intelligence.

Cases Stall or Acquittal Raises Questions About Attributing Cyberattacks to States

Uncertain

Discussed by: Civil-liberties advocates and defense attorneys focused on evidentiary challenges in cyber attribution

At trial, defense lawyers could argue that Dubranova was a bit player, or that prosecutors cannot reliably prove who was behind keyboards in Russia or how decisions were made. If jurors see too much technical complexity and too little direct evidence, they could acquit or hang. That would not stop U.S. sanctions or server seizures, but it would expose the limits of using criminal courts to adjudicate murky, cross‑border cyber attribution, forcing Washington to lean even more on intelligence, diplomacy, and cyber operations.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2012-01-01 to 2018-12-31 (indictments unsealed 2022-03-24)

U.S. Charges Russian Officials for Global Energy-Sector Hacking Campaigns

The Justice Department charged four Russian government employees with multi‑year campaigns targeting thousands of computers at energy companies and critical infrastructure operators worldwide. The alleged operations sought deep access to operational technology and, in at least one foreign facility, caused emergency shutdowns.

Then

The named officials stayed in Russia, but the indictments exposed tools, tradecraft, and targets.

Now

The case framed Russia as a systematic threat to industrial control systems, paving the way for more aggressive U.S. attribution and sanctions.

Why this matters now

Those earlier, largely theoretical campaigns set the stage; the Dubranova case alleges similar Russian-backed operations are now hitting everyday systems like local water and food plants inside the United States.

2015-12-23 to 2016-12-17

2015–2016 Cyberattacks on Ukraine’s Power Grid

Russian-linked hackers used malware like BlackEnergy and Industroyer to remotely open breakers and cut power to hundreds of thousands of Ukrainians. These were the first publicly acknowledged cyberattacks to successfully knock a power grid offline and were widely treated as test runs for using cyber tools to create physical damage.

Then

Ukraine restored power within hours but suffered repeated follow‑on attacks and costly grid repairs.

Now

The incidents became case studies for how states might use cyber operations against infrastructure in future conflicts.

Why this matters now

CARR’s alleged water and meat‑plant intrusions echo those early Ukrainian grid hacks: cyber tools used not just to deface websites, but to manipulate industrial equipment.

2021-05-07 to 2021-05-13

2021 Colonial Pipeline Ransomware Attack

Russia‑based criminal group DarkSide hit Colonial Pipeline with ransomware, forcing a shutdown that sparked fuel shortages and panic buying across the U.S. East Coast. Colonial reportedly paid a multimillion‑dollar ransom, part of which the U.S. later clawed back by seizing cryptocurrency.

Then

The attack disrupted fuel supplies, pushed gas prices up, and prompted emergency federal measures.

Now

It led to tougher U.S. cybersecurity rules for pipelines and reinforced the idea that Russian soil is a safe harbor for disruptive cyber actors.

Why this matters now

Colonial showed how criminals operating from Russia can threaten U.S. daily life; Dubranova’s case tests whether Washington can hold state‑backed actors more directly accountable.