Sector 16

About

Rewards for Justice is offering a reward of up to $10 million for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act (CFAA).

Under this reward offer, RFJ is offering up to $500,000 for information on individuals associated with Sector 16, a Russian government-sponsored hacking group that has targeted U.S. oil and gas production facilities. Sector 16 members utilize basic and unsophisticated intrusion techniques to gain access to industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems.

The novice-level pro-Russia hacking group first emerged in public in January 2025, when it posted a video with Russian hacktivist group Z-Pentest (also known as Cyber Army of Russia Reborn, or CARR), showing their cyber intrusion of a SCADA system managing oil pumps and storage tanks in Texas.

Sector 16 also has collaborated with pro-Russian malicious cyber group OverFlame.

In a May 2025 online interview posted on the pro-Russian YouTube channel “CyberYozh” (“Cyber Hedgehog” in English), Sector 16 founder Oleg Rut (Олег Рут) said he and his associates were initially part of CARR, which coalesced during Russia’s invasion of Ukraine.

Rut claimed that after CARR allegedly disbanded in late 2024 or early 2025, he and his associates formed Sector 16 to establish a presence in the information space. He also said that Sector 16 would re-brand itself under the name RUSCAD.

Sector 16 maintains an active online presence, including a public Telegram channel where they post videos and statements related to their activities, including claims of compromising U.S. energy infrastructure. The group’s messaging often aligns with pro-Russia narratives and reflects their self-proclaimed support for Russian geopolitical objectives.

The group is funded through donations, the sale of leaks obtained during their attacks and through underground crowdfunding platforms.