Sweden thwarted 2025 pro-Russian cyber attack on thermal power plant

Cyber & Information WarfareCyber AttacksAttacks on critical infrastructure (energy, transport, hospitals)

AggressorDefense

Summary

In mid-2025, Sweden thwarted a pro-Russian cyber attack targeting a thermal power plant in western Sweden, identifying attackers linked to Russian intelligence.

In mid-2025, Swedish authorities prevented a cyber attack aimed at disrupting the operations of a thermal power plant supplying heating in western Sweden. The Swedish Security Service attributed the attack to a group linked to Russian intelligence. The attack targeted not only IT systems but also operational technology controlling physical infrastructure, signaling a more sophisticated approach by attackers. Civil Defence Minister Carl-Oskar Bohlin highlighted the risk of physical sabotage through cyber means and indicated the attack failed due to robust security systems. Sweden disclosed the incident publicly to raise awareness and deter threat actors amid increasing Russian cyber threats since its 2022 invasion of Ukraine. Experts noted the rising complexity of such attacks, including the use of AI to exploit vulnerabilities in control systems. The Swedish government maintains strong support for Ukraine while reinforcing national cybersecurity and resilience.

Classification

Confidence: High

Classified as aggressor because the event describes a pro-Russian cyberattack attempt on Sweden's critical energy infrastructure linked to Russian intelligence. Classified as defense because the attack was thwarted by Swedish security services who identified the adversaries and employed effective cybersecurity defenses.

Source URL

https://macaubusiness.com/sweden-thwarted-2025-pro-russian-cyber-attack-on-thermal-power-plant-2

Open source

Provenance

Publisher: extension
Submitted: Apr 15, 2026, 18:25 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Jun 15, 2025, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "657e77aa-4f3f-45fc-a70b-24d0a939474d",
  "url": "https://macaubusiness.com/sweden-thwarted-2025-pro-russian-cyber-attack-on-thermal-power-plant-2",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Sweden",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "cyberattacks",
    "Russia",
    "Sweden",
    "thermal power plant",
    "operational technology",
    "offensive cyber operations",
    "russian intelligence operations",
    "critical infrastructure",
    "hybrid warfare",
    "2025"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "Sweden"
  ],
  "where_text": "Cyberspace",
  "headline": "Sweden thwarted 2025 pro-Russian cyber attack on thermal power plant",
  "description": "In mid-2025, Sweden successfully thwarted a pro-Russian cyber attack targeting a thermal power plant located in western Sweden. The Swedish Security Service identified the attackers as linked to Russian intelligence and security services. The attack aimed to disrupt the functioning of the heating supply facility but failed due to effective security measures. The incident marks an evolution in cyber threats, with attackers moving beyond simple denial of service attacks to targeting operational technology (OT) systems controlling physical infrastructure. Swedish Civil Defence Minister Carl-Oskar Bohlin emphasized the seriousness of these threats, which could cause physical disruptions akin to sabotage. Authorities publicly disclosed the event to raise awareness and signal capability to threat actors. The Swedish government continues to take cybersecurity threats seriously, reaffirming unwavering support to Ukraine amid heightened Russian cyber aggression since the 2022 invasion.",
  "summary_short": "In mid-2025, Sweden thwarted a pro-Russian cyber attack targeting a thermal power plant in western Sweden, identifying attackers linked to Russian intelligence.",
  "summary_extended": "In mid-2025, Swedish authorities prevented a cyber attack aimed at disrupting the operations of a thermal power plant supplying heating in western Sweden. The Swedish Security Service attributed the attack to a group linked to Russian intelligence. The attack targeted not only IT systems but also operational technology controlling physical infrastructure, signaling a more sophisticated approach by attackers. Civil Defence Minister Carl-Oskar Bohlin highlighted the risk of physical sabotage through cyber means and indicated the attack failed due to robust security systems. Sweden disclosed the incident publicly to raise awareness and deter threat actors amid increasing Russian cyber threats since its 2022 invasion of Ukraine. Experts noted the rising complexity of such attacks, including the use of AI to exploit vulnerabilities in control systems. The Swedish government maintains strong support for Ukraine while reinforcing national cybersecurity and resilience.",
  "actor_primary": "Pro-Russian cyber attackers linked to Russian intelligence and security services",
  "target_primary": null,
  "location_text": "Western Sweden",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "Classified as aggressor because the event describes a pro-Russian cyberattack attempt on Sweden's critical energy infrastructure linked to Russian intelligence. Classified as defense because the attack was thwarted by Swedish security services who identified the adversaries and employed effective cybersecurity defenses.",
  "event_time_utc": "2025-06-15T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-15T18:25:00.366Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Jun 15, 2025, 00:00 UTC

Event time confidence

pm24h

Location

Western Sweden

Primary actor

Pro-Russian cyber attackers linked to Russian intelligence and security services

Country

Sweden

Countries

Sweden

Tags

cyberattacks, Russia, Sweden, thermal power plant, operational technology, offensive cyber operations, russian intelligence operations, critical infrastructure, hybrid warfare, 2025

Nodes

Node 1: Borders

Loading signal...

{ "id": "657e77aa-4f3f-45fc-a70b-24d0a939474d", "url": "https://macaubusiness.com/sweden-thwarted-2025-pro-russian-cyber-attack-on-thermal-power-plant-2", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)", "country": "Sweden", "source_reliability": "C", "info_credibility": "3", "tags": [ "cyberattacks", "Russia", "Sweden", "thermal power plant", "operational technology", "offensive cyber operations", "russian intelligence operations", "critical infrastructure", "hybrid warfare", "2025" ], "nodes": [ "Node 1: Borders" ], "countries": [ "Sweden" ], "where_text": "Cyberspace", "headline": "Sweden thwarted 2025 pro-Russian cyber attack on thermal power plant", "description": "In mid-2025, Sweden successfully thwarted a pro-Russian cyber attack targeting a thermal power plant located in western Sweden. The Swedish Security Service identified the attackers as linked to Russian intelligence and security services. The attack aimed to disrupt the functioning of the heating supply facility but failed due to effective security measures. The incident marks an evolution in cyber threats, with attackers moving beyond simple denial of service attacks to targeting operational technology (OT) systems controlling physical infrastructure. Swedish Civil Defence Minister Carl-Oskar Bohlin emphasized the seriousness of these threats, which could cause physical disruptions akin to sabotage. Authorities publicly disclosed the event to raise awareness and signal capability to threat actors. The Swedish government continues to take cybersecurity threats seriously, reaffirming unwavering support to Ukraine amid heightened Russian cyber aggression since the 2022 invasion.", "summary_short": "In mid-2025, Sweden thwarted a pro-Russian cyber attack targeting a thermal power plant in western Sweden, identifying attackers linked to Russian intelligence.", "summary_extended": "In mid-2025, Swedish authorities prevented a cyber attack aimed at disrupting the operations of a thermal power plant supplying heating in western Sweden. The Swedish Security Service attributed the attack to a group linked to Russian intelligence. The attack targeted not only IT systems but also operational technology controlling physical infrastructure, signaling a more sophisticated approach by attackers. Civil Defence Minister Carl-Oskar Bohlin highlighted the risk of physical sabotage through cyber means and indicated the attack failed due to robust security systems. Sweden disclosed the incident publicly to raise awareness and deter threat actors amid increasing Russian cyber threats since its 2022 invasion of Ukraine. Experts noted the rising complexity of such attacks, including the use of AI to exploit vulnerabilities in control systems. The Swedish government maintains strong support for Ukraine while reinforcing national cybersecurity and resilience.", "actor_primary": "Pro-Russian cyber attackers linked to Russian intelligence and security services", "target_primary": null, "location_text": "Western Sweden", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "Classified as aggressor because the event describes a pro-Russian cyberattack attempt on Sweden's critical energy infrastructure linked to Russian intelligence. Classified as defense because the attack was thwarted by Swedish security services who identified the adversaries and employed effective cybersecurity defenses.", "event_time_utc": "2025-06-15T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-15T18:25:00.366Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }