Meduza summarizes a Bloomberg investigation on Russia-linked hacker groups sabotaging industrial control systems in Western countries, causing physical damage to utilities, factories, and food production. Since Russia’s full-scale invasion of Ukraine, Moscow-linked actors have shifted from defacing websites to targeting critical infrastructure and industrial operations.

In Spain between late 2024 and summer 2026, multiple industrial disruptions occurred: crematorium ovens at a funeral home in Alicante province stopped working; equipment at a Catalonia factory producing transformers for renewable energy systems malfunctioned and triggered a fire; and two Spanish wineries were forced to halt operations when hacked heating and ventilation systems drove temperatures dangerously high in production and storage areas.

In Denmark, a December 2024 attack on the village water system in Tureby affected about 450 homes. Attackers altered the pressure setting in the electronic pump control to zero, cutting water service. After local workers restored operations, pressure later surged, bursting underground pipes and causing leaks. The committee chair managing the local water supply, Jan Hansen, lost access to the control panel and arrived at the pumping station to find the pump running out of control. Technicians from Danish manufacturer Evotect ApS determined the controller had been hacked. Hansen later acknowledged that the municipality had chosen a cheap control system secured with the default password "1234."

In the United States in 2024, hackers shut down refrigeration at a meatpacking plant near Los Angeles, spoiling more than 2,000 pounds (around 900 kilograms) of meat and causing an ammonia leak that forced an evacuation. That same year, attackers compromised a public water system in Texas, altering settings so an unknown volume of drinking water spilled from storage tanks. In October 2024, hackers accessed a Pennsylvania waste treatment plant’s control system and tampered with equipment used to kill bacteria in wastewater.

Bloomberg’s source reporting and Western authorities attribute many such attacks to Russia-linked groups, notably Cyber Army of Russia Reborn (CARR) and Z-Pentest. CARR is tied to Russia’s military intelligence agency, the Main Directorate of the General Staff (formerly the GRU). The group has repeatedly claimed responsibility for attacks in Europe and the U.S., including intrusions into water systems in the U.S. and Poland and a power plant in France. CARR members have been placed under U.S. and European Union sanctions.

Z-Pentest formed in September 2024, reportedly by breakaway members of CARR collaborating with pro-Russian hacktivist collective NoName057(16). According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), some CARR operators were dissatisfied with GRU support and created Z-Pentest to focus on industrial sabotage. The EU has sanctioned Z-Pentest, holding it responsible for cyberattacks on critical infrastructure, especially in the energy and water sectors; the group itself has publicly claimed involvement in such operations.

Bloomberg highlights alleged facilitators. Ukrainian citizen Victoria Dubranova was charged by the U.S. Justice Department in late 2025 with participating in Russian state-linked cyberattacks. Prosecutors allege she worked with both CARR and Z-Pentest since at least autumn 2022, recruited via a remote-work chat group. She allegedly produced and edited propaganda videos, assisted in target selection, and provided a database containing personal data on individuals in Ukraine, Romania, and Moldova. She is in custody and denies the hacking charges; Z-Pentest publicly stated she had not engaged in hacking. In March (year not specified in the Meduza summary but contextually 2026), Italian citizen Chris Barlati was arrested in Spain. Spanish police allege he acted as an intermediary for the hackers, assisting with target selection and other tasks; U.S. investigators further accuse him of attempting to help Dubranova flee Ukraine to Russia via Europe. He has pleaded not guilty and is not currently in custody.

Experts quoted in the article stress that attackers commonly exploit basic security weaknesses in poorly secured industrial control systems, rather than using highly sophisticated techniques. Cian Heasley, principal consultant at U.K. cybersecurity firm Acumen Cyber, notes surprise that a large-scale catastrophe has not yet occurred, given the potential for serious damage through either malice or incompetence. In September 2025, U.S. firm Forescout Technologies deployed a honeypot—a fake industrial control system mimicking a Dutch water facility. A hacker group called TwoNet, described as similar to Z-Pentest, broke into the decoy system and then falsely claimed to have hacked a real water facility, illustrating both the opportunism and the tendency of such groups to exaggerate their impact. Simon Berner, lead cyber threat intelligence analyst at Estonia’s National Cyber Security Center, warns that even relatively unsophisticated actors become dangerous as they probe widely for weak points: the more they "poke around," the higher the likelihood they eventually find a poorly protected but critical system.

CISA assesses that groups like Z-Pentest are motivated primarily by a desire to sow chaos rather than to achieve precise strategic effects. This opportunism allows them to target any inadequately defended system, often in the energy, water, food, and industrial sectors, and then overstate the severity of their intrusions in public claims. The campaign profile described across Spain, Denmark, the U.S., Poland, France, and other Western targets is consistent with Russian hybrid warfare tactics using cyber sabotage against civilian infrastructure.

Meduza summarizes a Bloomberg investigation on Russia-linked hacker groups sabotaging industrial control systems in Western countries, causing physical damage to utilities, factories, and food production. Since Russia’s full-scale invasion of Ukraine, Moscow-linked actors have shifted from defacing websites to targeting critical infrastructure and industrial operations.

In Spain between late 2024 and summer 2026, multiple industrial disruptions occurred: crematorium ovens at a funeral home in Alicante province stopped working; equipment at a Catalonia factory producing transformers for renewable energy systems malfunctioned and triggered a fire; and two Spanish wineries were forced to halt operations when hacked heating and ventilation systems drove temperatures dangerously high in production and storage areas.

In Denmark, a December 2024 attack on the village water system in Tureby affected about 450 homes. Attackers altered the pressure setting in the electronic pump control to zero, cutting water service. After local workers restored operations, pressure later surged, bursting underground pipes and causing leaks. The committee chair managing the local water supply, Jan Hansen, lost access to the control panel and arrived at the pumping station to find the pump running out of control. Technicians from Danish manufacturer Evotect ApS determined the controller had been hacked. Hansen later acknowledged that the municipality had chosen a cheap control system secured with the default password "1234."

In the United States in 2024, hackers shut down refrigeration at a meatpacking plant near Los Angeles, spoiling more than 2,000 pounds (around 900 kilograms) of meat and causing an ammonia leak that forced an evacuation. That same year, attackers compromised a public water system in Texas, altering settings so an unknown volume of drinking water spilled from storage tanks. In October 2024, hackers accessed a Pennsylvania waste treatment plant’s control system and tampered with equipment used to kill bacteria in wastewater.

Bloomberg’s source reporting and Western authorities attribute many such attacks to Russia-linked groups, notably Cyber Army of Russia Reborn (CARR) and Z-Pentest. CARR is tied to Russia’s military intelligence agency, the Main Directorate of the General Staff (formerly the GRU). The group has repeatedly claimed responsibility for attacks in Europe and the U.S., including intrusions into water systems in the U.S. and Poland and a power plant in France. CARR members have been placed under U.S. and European Union sanctions.

Z-Pentest formed in September 2024, reportedly by breakaway members of CARR collaborating with pro-Russian hacktivist collective NoName057(16). According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), some CARR operators were dissatisfied with GRU support and created Z-Pentest to focus on industrial sabotage. The EU has sanctioned Z-Pentest, holding it responsible for cyberattacks on critical infrastructure, especially in the energy and water sectors; the group itself has publicly claimed involvement in such operations.

Bloomberg highlights alleged facilitators. Ukrainian citizen Victoria Dubranova was charged by the U.S. Justice Department in late 2025 with participating in Russian state-linked cyberattacks. Prosecutors allege she worked with both CARR and Z-Pentest since at least autumn 2022, recruited via a remote-work chat group. She allegedly produced and edited propaganda videos, assisted in target selection, and provided a database containing personal data on individuals in Ukraine, Romania, and Moldova. She is in custody and denies the hacking charges; Z-Pentest publicly stated she had not engaged in hacking. In March (year not specified in the Meduza summary but contextually 2026), Italian citizen Chris Barlati was arrested in Spain. Spanish police allege he acted as an intermediary for the hackers, assisting with target selection and other tasks; U.S. investigators further accuse him of attempting to help Dubranova flee Ukraine to Russia via Europe. He has pleaded not guilty and is not currently in custody.

Experts quoted in the article stress that attackers commonly exploit basic security weaknesses in poorly secured industrial control systems, rather than using highly sophisticated techniques. Cian Heasley, principal consultant at U.K. cybersecurity firm Acumen Cyber, notes surprise that a large-scale catastrophe has not yet occurred, given the potential for serious damage through either malice or incompetence. In September 2025, U.S. firm Forescout Technologies deployed a honeypot—a fake industrial control system mimicking a Dutch water facility. A hacker group called TwoNet, described as similar to Z-Pentest, broke into the decoy system and then falsely claimed to have hacked a real water facility, illustrating both the opportunism and the tendency of such groups to exaggerate their impact. Simon Berner, lead cyber threat intelligence analyst at Estonia’s National Cyber Security Center, warns that even relatively unsophisticated actors become dangerous as they probe widely for weak points: the more they "poke around," the higher the likelihood they eventually find a poorly protected but critical system.

CISA assesses that groups like Z-Pentest are motivated primarily by a desire to sow chaos rather than to achieve precise strategic effects. This opportunism allows them to target any inadequately defended system, often in the energy, water, food, and industrial sectors, and then overstate the severity of their intrusions in public claims. The campaign profile described across Spain, Denmark, the U.S., Poland, France, and other Western targets is consistent with Russian hybrid warfare tactics using cyber sabotage against civilian infrastructure.