Russian Hackers Target US Water Utilities and European Infrastructure
A Russian hacker group known as “Cyber Army of Russia Reborn” has been caught infiltrating and manipulating the control systems of water utilities in Texas, a wastewater treatment plant in Poland, and a small water mill in France. The group has posted videos on Telegram showcasing their chaotic tampering with the software that controls physical equipment within these targeted networks.
Ties to Sandworm, Russia’s Military Intelligence Unit
Cybersecurity firm Mandiant has published a report linking Cyber Army of Russia Reborn to Sandworm, a notorious hacking group identified as Unit 74455 of Russia’s GRU military intelligence agency. Mandiant discovered evidence that Sandworm assisted in the creation of Cyber Army of Russia Reborn and observed instances where data stolen from networks attacked by Sandworm was subsequently leaked by the new group.
John Hultquist, head of Mandiant’s threat-intelligence efforts, notes that Cyber Army of Russia Reborn’s actions have been more brazen than Sandworm’s, directly targeting US networks with disruptive cyberattacks, something Sandworm has never done before.
“Even though this group is operating under this persona that’s tied to Sandworm, they do seem more reckless than any Russian operator we’ve ever seen targeting the United States. They’re actively manipulating operational technology systems in a way that’s highly aggressive, probably disruptive, and dangerous.”
Attacks on Water Utilities and Infrastructure
In mid-January, Cyber Army of Russian Reborn posted a video showing screen recordings of their manipulation of control systems for water utilities in Abernathy and Muleshoe, Texas. Local officials acknowledged the cyberattacks and confirmed some level of disruption, with one water tank overflowing in Muleshoe.
Another video posted in January showed the hackers tampering with the control systems of a wastewater utility in Wydminy, Poland, a country that has been a strong supporter of Ukraine during Russia’s invasion.
In March, the hackers targeted what they believed to be the Courlon Sur Yonne hydroelectric dam in France, but it was later revealed by the French newspaper Le Monde that they had actually accessed the control system for a small water mill in a village of 300 people.
Hackers’ Knowledge and Impact
While the hackers displayed some understanding of how water utilities operate, they also made seemingly arbitrary changes that had no effect, according to Gus Serino, founder of cybersecurity firm I&C Secure and a former staffer at a water utility and infrastructure cybersecurity firm Dragos.
The extent of the damage or disruption caused by these cyberattacks remains unclear, but the brazen nature of Cyber Army of Russia Reborn’s actions has raised concerns about the vulnerability of critical infrastructure to such threats.
2 Comments
Looks like cybersecurity’s more of a pipe dream in this scenario!
Can’t we just have a glass of water without drama?