EPA: Foreign national charged in Russian-linked cyberattacks on U.S. water systems

Federal officials have charged a Ukrainian national for allegedly supporting two Russia-linked cybercriminal groups responsible for dozens of attacks on critical infrastructure, including public drinking water systems in the United States. The indictments against Victoria Eduardovna Dubranova, 33, were unsealed December 9 in the U.S. District Court for the Central District of California.

Dubranova is accused of acting on behalf of CyberArmyofRussia_Reborn (CARR)—a GRU-directed group—and NoName057(16), both of which have targeted U.S. and international infrastructure. According to the CARR indictment, the group conducted destructive intrusions involving industrial control systems and DDoS attacks, including incidents that damaged water system controls and caused spills of hundreds of thousands of gallons of drinking water across several states.

Dubranova, who was extradited earlier this year, pleaded not guilty to charges that include conspiracy to damage protected computers, tampering with public water systems, and aggravated identity theft. Trials in the two cases are scheduled for February and April 2026.

EPA officials emphasized the seriousness of targeting water utilities. “The defendant’s illegal actions to tamper with the nation’s public water systems put communities and the nation’s drinking water resources at risk,” said EPA Acting Assistant Administrator for Enforcement and Compliance Assurance Craig Pritzlaff in a press release. “These criminal charges serve as an unequivocal warning to malicious cyber actors in the U.S. and abroad: EPA’s Criminal Investigation Division and our law enforcement partners will not tolerate threats to our nation’s water infrastructure and will pursue justice against those who endanger the American public. EPA is unwavering in its commitment to clean, safe water for all Americans.”

The FBI, DOJ, and EPA described the case as part of a broader federal effort—Operation Red Circus—to disrupt Russian state-sponsored and state-sanctioned cyberthreats. U.S. authorities also announced a $2 million reward for information related to CARR members.

If convicted, Dubranova faces up to 27 years in federal prison.