A Russian national pleaded guilty April 30 in federal court in Los Angeles to conspiracy to damage protected computer systems, wire fraud, and aggravated identity theft, admitting to a series of cyberattacks on energy infrastructure across the United States, Ukraine, and Europe as a member of a Kremlin-aligned hacking group.
The defendant faces up to 27 years in prison. He entered the plea in exchange for a sentencing recommendation, according to court records first reported by Bloomberg.
Prosecutors say he was a member of Sector16, a hacker group that broke off from a larger Russian cyber collective known as the People’s Cyber Army of Russia and publicly emerged in January 2025. Federal investigators describe Sector16 as an amateur group operating in the interests of the Russian government.
According to the indictment, filed April 21, the group breached a SCADA industrial control system at an oil facility in Texas in January 2025, seizing control of pumps and storage tanks. Hackers also compromised a natural gas facility in North Dakota and explored selling that access to the Russian government, court records show. Facilities in New York and Pennsylvania were also penetrated.
Simultaneously, the group prepared attacks on Ukrainian infrastructure. In September 2025, Sector16 gained access to a gas facility in the Poltava region of Ukraine. Court filings quote the defendant’s messages discussing how to deform a gas pipeline and overload ventilation and extraction equipment. Prosecutors allege the group was offered $75,000 to orchestrate an explosion. A pitch document prepared by the defendant referenced «fires and explosions» that could cause casualties.
In separate messages, the defendant told an associate he expected to receive the equivalent of roughly $55,000 — five million rubles — for cutting power across Ukraine for three days. «The project is already launched. The money has already been paid,» he wrote, according to court records. That attack was never carried out.
Sector16 funded its operations through a hotel fraud scheme, using stolen payment credentials to book hotel rooms and splitting proceeds with participating properties that agreed not to flag the transactions as fraudulent. Investigators estimate the scheme generated more than $150,000 over several months in 2024.
The defendant was arrested November 2, 2025, in the Dominican Republic, transferred to New Jersey, and later moved to California. His attorney confirmed the arrest. The defendant has not made any public statements.
Russian investigative outlet Agentstvo reported, citing leaked documents, that between 2021 and 2023 the defendant worked as a senior analytics specialist at the Alabuga special economic zone in the Republic of Tatarstan — a facility where Russia assembles a domestic version of Iranian-designed Shahed drones used in strikes on Ukrainian cities. U.S. court filings do not draw a connection between his work at Alabuga and the Sector16 attacks.
No sentencing date has been set in the Central District of California.