Russia-linked hackers are exploiting poorly secured industrial systems to sabotage factories, utilities, and food production across the West, Bloomberg reports

After Russia launched its full-scale invasion of Ukraine, Moscow-linked hacker groups began targeting not only the websites of government and private organizations in the West but also critical infrastructure and businesses, Bloomberg reported in a lengthy feature. Targets have included water facilities, factories, and food companies. The attacks have caused pipes to burst, food to spoil, and fires to break out. Meduza summarizes the report’s key findings.What the attacks targetedSpainCrematorium ovens at a funeral home in Alicante province stopped working.Equipment used to manufacture transformers for renewable energy systems malfunctioned at a factory in Catalonia, where a fire broke out.Two Spanish wineries halted operations after their heating and ventilation systems were disrupted, sending temperatures soaring in production and storage areas.The incidents in Spain took place from late 2024 to the summer of 2026.DenmarkIn mid-December 2024, 450 homes in the Danish village of Tureby lost their water supply. The pressure setting in the electronic control system had been turned to zero. Local workers restarted the water pumps.The next day, the pressure suddenly surged, causing underground pipes to burst and leak. Jan Hansen, who chaired the committee managing the local water supply, discovered that he could no longer access the control panel. When he arrived at the pumping station, he found the pump running out of control.Technicians from Evotect ApS, the Danish company that manufactured the pump controller, determined that the system had been hacked. Hansen later admitted that they had chosen a cheap system to control the water supply and that its password was 1234.United StatesIn 2024, hackers shut off refrigeration at a meatpacking plant near Los Angeles. More than 2,000 pounds (about 900 kilograms) of meat spoiled, and an ammonia leak forced workers to evacuate.That same year, hackers attacked a public water system in Texas. They changed the control settings, causing an unknown volume of drinking water to spill from storage tanks.In October of that year, hackers broke into a waste treatment facility’s control system in Pennsylvania and tampered with equipment used to kill bacteria.Who is carrying out the attacksCyber Army of Russia Reborn (CARR)A hacker group linked to Russia’s military intelligence agency, the Main Directorate of the General Staff, formerly known as the GRUHas repeatedly claimed responsibility for attacks in Europe and the United States, including on water systems in the United States and Poland and a power plant in FranceMembers are under U.S. and European Union sanctionsZ-PentestA hacker group formed in September 2024 by members of CARR and NoName057(16)According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), some CARR members were unhappy with the level of support from the GRU and decided to break away, forming their own group focused on industrial sabotageUnder European Union sanctions: The EU holds the group responsible for attacks on critical infrastructure, particularly in the energy and water sectors. The group has also publicly claimed involvement in such attacksVictoria DubranovaBloomberg gives a detailed account of Victoria Dubranova, a Ukrainian citizen whom the U.S. Justice Department accused in late 2025 of participating in cyberattacks on Russia’s behalf.Dubranova has been charged with working for Cyber Army of Russia Reborn and Z-Pentest. She is in custody and denies the charges. According to the Justice Department, she had been working with the hackers since at least the fall of 2022. She was recruited through a chat group for people seeking remote work.She allegedly created and edited videos for the hackers, helped identify targets, and gave them a database containing personal information about people in Ukraine, Romania, and Moldova. Z-Pentest said Dubranova had not engaged in hacking.Chris BarlatiIn March, Italian citizen Chris Barlati was arrested in Spain. Spanish police said Barlati acted as an intermediary for the hackers and helped select targets, among other things. U.S. investigators also allege that he tried to help Dubranova flee Ukraine for Russia via Europe. He has pleaded not guilty and is not currently in police custody.What experts say about the attacksIn the attacks described above, hackers most often exploited vulnerabilities in poorly secured systems. They can cause serious damage through either malice or incompetence. “I am genuinely surprised that we haven’t yet seen a catastrophe,” said Cian Heasley, a principal consultant at the British cybersecurity company Acumen Cyber.In September 2025, the U.S. company Forescout Technologies created a dummy industrial control system designed to look as though it served a Dutch water facility. The company said a hacker group called TwoNet, similar to Z-Pentest, broke into the system and then claimed to have successfully attacked the fictitious facility. Such amateurishness does not make the hackers any less dangerous, said Simon Berner, lead cyber threat intelligence analyst at Estonia’s National Cyber Security Center:Even if the level of sophistication is not too big, the problem is that the more they poke around, the more it is probable they can find something critical that wasn’t protected well.The desire simply to sow chaos gives groups such as Z-Pentest the freedom to choose whichever targets are poorly defended. “Rather than focusing on strategically significant targets, they are opportunistic and breach whatever is available to them,” CISA said in its report. The agency also warned that these groups exaggerate their capabilities and the impact of their actions, portraying minor incursions as significant breaches.At Meduza, we are committed to transparency about our use of artificial intelligence in the newsroom. The story you’re reading was written by one of our living, breathing journalists and translated from Russian using an AI model configured to follow our strict editorial standards. This translation process is the result of extensive testing and refinements to ensure our English-language coverage is timely and accurate. A Meduza editor reviews every draft before publication.If you find any errors in this translation, please contact us at [email protected].To read Meduza’s exclusive content in English, please subscribe to our newsletter.