Z-Pentest
Attribution profile
- Type
- Nation State
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2025-11-01
- Last seen
- 2025-11-01
- Updated
- 2026-10-17 09:05
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Z-Pentest (also known as Z-Pentest) is a pro‑Russian hacking group linked to the Russian state. It has been observed targeting critical infrastructure in Western nations, notably carrying out a destructive cyberattack against a Danish water utility in November 2025 by manipulating water‑pressure controls to burst pipes and disrupt supply. The attack was conducted as part of Russia’s hybrid warfare campaign against countries supporting Ukraine, with the explicit aim of creating instability and inflicting punishment rather than for financial gain or espionage. No specific malware families, initial‑access vectors or tooling details are described in the public reporting; the group's activity is characterized by operational‑technology manipulation to cause physical disruption. The Danish water‑utility incident represents its most clearly documented operation to date.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.