GRU-linked fronts breached internet-exposed industrial controls across NATO

GRU-linked hacktivist fronts CARR and Z-Pentest breached internet-exposed industrial control systems using default VNC passwords to cause physical damage across NATO nations including the United States, Bloomberg confirmed on Oct. 27, 2026.

The campaign spanned two years and reached at least four countries – Denmark, the United States, Spain and other NATO members. Bloomberg’s investigation framed the range of targets – municipal water, food production, manufacturing and waste treatment – as a deliberate strategy to maximize disruption across civilian life.

Every documented intrusion relied on the same setup: industrial control devices facing the public internet, running Virtual Network Computing on default port 5900 and guarded by weak or default passwords. Virtual Network Computing transmits a machine’s full graphical interface over a network, so an intruder who finds the device and guesses the password can control pumps, valves, temperature regulators and pressure setpoints as if sitting at the console. The attackers located targets through the public scanning services Shodan and FOFA; no specialized exploit, zero-day vulnerability or nation-state capability was required.

In December 2024, attackers remotely accessed industrial controls at a waterworks in Tureby, Denmark, zeroed out pressure settings and waited for workers to restart the pumps manually before surging pressure until underground pipes burst. The access password was “1234.” One account says 450 homes were without water for days, while other reporting puts 450 homes without supply for one hour and 50 households without water for seven hours. Danish intelligence identified the site as the Tureby Alkestrup Waterworks, serving about 500 households in villages around 35 kilometers south of Copenhagen, and said at least three pipes burst in Koge Municipality.

Denmark’s Defence Intelligence Service publicly attributed the destructive 2024 water utility attacks to Z-Pentest and linked election-period denial-of-service attacks to NoName057(16), calling both tools of Russia’s hybrid war against the West. It was Denmark’s first public attribution of such attacks to Moscow. Denmark summoned Russia’s ambassador in response, and Defence Minister Troels Lund Poulsen called the attacks completely unacceptable. Danish intelligence said Z-Pentest attacked the Tureby Alkestrup Waterworks in late 2024 by altering water pressure, causing at least three pipes to burst in Koge, 35 kilometers south of Copenhagen.

Jan Hansen, head of the Tureby Alkestrup Waterworks, said the breach succeeded because the utility had moved to cheaper, less secure cybersecurity, and he urged other firms not to cut security costs and to buy cyber insurance. Torsten Schack Pedersen, Denmark’s minister of resilience and preparedness, said the attacks caused limited damage but revealed forces capable of shutting down important parts of society.

In November 2024, attackers shut down refrigeration at a meatpacking facility near Los Angeles, spoiling more than 2,000 pounds of meat and triggering an ammonia leak that required worker evacuation. Also in 2024, attackers changed control settings at a Texas public water system, causing water to overflow from tanks. In October 2024, intruders entered a Pennsylvania waste treatment plant’s control system and interfered with equipment meant to remove bacteria from wastewater.

In Spain, hackers disrupted crematorium ovens at a funeral home in Alicante province. A factory in Catalonia that makes transformers for renewable-energy systems had equipment pushed beyond its operating limits, starting a fire. Attackers also disrupted heating and ventilation controls at two Spanish wineries, halting production and driving storage and production-area temperatures to dangerous levels.

The Cyber Army of Russia Reborn, known as CARR, launched in February 2022 alongside Russia’s full-scale invasion of Ukraine, at first running denial-of-service attacks and website defacements. The group pivoted to industrial control system intrusions by October 2023 and claimed its first ICS attack that month against a European wastewater treatment facility. A December 2025 U.S. Department of Justice indictment found that Russia’s military intelligence agency, the GRU, founded, funded and directed CARR.

The indictment named the Main Center for Special Technologies, also called GRU Unit 74455, as the unit behind CARR; that unit also carried out the 2017 NotPetya malware attack and repeated strikes on Ukraine’s power grid. The GRU directed CARR’s targeting and financed commercial denial-of-service subscriptions paid in Russian rubles through a figure using the handle Cyber_1ce_Killer. The U.S. Justice Department has said GRU guidance paid for CARR attacks on U.S. water systems and a meat facility in Los Angeles, resulting in spills, leaks and damage.

Z-Pentest appeared in September 2024 after Cyber Army of Russia Reborn administrators unhappy with the GRU funding split off together with members of the pro-Russia group NoName057(16). Unlike CARR, which gradually added industrial targeting to a broader hacktivism portfolio, Z-Pentest was purpose-built for industrial sabotage. The group concentrates almost entirely on industrial control and supervisory control and data acquisition systems that run pumps, valves, heat exchangers and manufacturing machinery, according to ENISA and Orange Cyberdefense.

Cyble counted 38 Z-Pentest industrial control system attacks in the second quarter of 2025, a rise of more than 150 percent from the previous three months, making it the leading hacktivist group worldwide in industrial control system targeting. Orange Cyberdefense released a dedicated threat intelligence brief on Z-Pentest covering its methods, infrastructure and country targets including Italy, Spain and other European Union states. A December 2025 CISA advisory said Z-Pentest formed after CARR and NoName057(16) administrators grew unhappy with GRU support and works more independently of direct state control.

Z-Pentest publicly claims to be behind hundreds of cyberattacks against critical infrastructure around the world, including attacks on U.S. drinking water systems that damaged controls and spilled hundreds of thousands of liters of water. Denmark’s Defence Intelligence Service said Z-Pentest has connections to the Russian state, and that NoName057(16), behind 2025 election website overload attacks, also has Russian state connections. Since March 2022, NoName057(16) has conducted denial-of-service attacks against government and private sector targets in NATO countries and other European nations using Telegram channels, proprietary DDoSia software, cryptocurrency payments and daily Telegram leaderboards.

A joint advisory, AA25-343A, released in December 2025 by CISA, the FBI, the NSA, the Department of Energy, the Environmental Protection Agency and international partners, identified CARR, Z-Pentest, NoName057(16 and Sector16 as groups actively scanning internet-facing operational technology with open VNC connections. CISA characterized CARR and Z-Pentest as opportunistic actors targeting poorly defended systems rather than strategic objectives, and warned that their routine exaggeration of breach scale makes risk harder to assess without eliminating real-world danger.

The advisory built on a CISA fact sheet from May 6, 2025 and EC3 Operation Eastwood, in which U.S. and EU agencies shared information about cyber incidents affecting operational technology and industrial control systems at critical infrastructure entities in the United States and globally. CISA said these hacktivist attacks are less sophisticated and lower-impact than advanced persistent threat groups but have caused varying degrees of impact including physical damage without yet causing injuries.

In September 2025, Forescout Technologies deployed a honeypot resembling a Dutch water facility, and a group called TwoNet breached it within weeks using tactics identical to Z-Pentest’s. TwoNet falsely claimed to have attacked a real facility, illustrating the groups’ opportunistic methods and tendency to exaggerate breach scale.

Under NATO’s Article Five collective defence clause, an armed attack on a member state triggers collective defence, but cyber-physical attacks on civilian infrastructure through nominally civilian proxy groups do not automatically meet that threshold, even when secretly funded and directed by military intelligence. Russian military intelligence’s use of proxy groups is a deliberate hybrid warfare tactic used since at least 2014 to keep attacks below the armed attack threshold and complicate attribution.

Western cyber officials said the broader campaign amounts to Russia making life difficult for Europe because of continued support for Ukraine, a characterization that Kremlin-connected sources spelled out, according to Bloomberg. Danish officials said Denmark lacks adequate preparation for Russian hybrid attacks, pointing out that recent cyber and drone incidents caused limited damage while revealing serious gaps in national resilience.

The U.S. Treasury Department sanctioned Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko in July 2024 for their roles in the Texas water-tank overflow and the compromise of a U.S. energy company’s SCADA systems. In July 2026, the European Union and the United Kingdom issued parallel sanctions against more GRU officers linked to CARR and Z-Pentest.

The U.S. Justice Department indicted 33-year-old Ukrainian national Victoria Eduardovna Dubranova in January 2025, and she was arraigned in December 2025 after extradition to the United States. She entered a not-guilty plea in two cases linked to CARR and NoName057(16. Those charges include conspiracy to damage protected computers and tampering with public water systems. Access device fraud is among them, and so is aggravated identity theft.

The Justice Department alleges Dubranova worked with the groups since at least autumn 2022, recruited through a remote-work chat group, creating propaganda videos, helping identify targets and providing a database of personal information from people in Ukraine, Romania and Moldova. A December 2025 DOJ indictment alleges CARR’s Telegram channel reached more than 75,000 followers at its peak and kept over 100 active members, some of whom are minors.

Z-Pentest publicly stated Dubranova had not engaged in hacking herself; she faces up to 27 years in federal prison if convicted on all CARR-related charges, and her CARR trial was set to start April 7, 2026. Italian national Chris Barlati was arrested in Spain in March 2026. Spanish prosecutors say he acted as a hacker go-between and helped pick targets, and U.S. investigators say he attempted to assist Dubranova in leaving Ukraine for Russia through Europe. He has pleaded not guilty and remains free of police custody.

The U.S. State Department offers rewards of up to $2 million through the Rewards for Justice program for information on additional co-conspirators tied to CARR and Z-Pentest. The United States is also offering up to $10 million for information about individuals connected to NoName057(16).

The EU’s NIS2 Directive took effect in October 2024 and requires critical infrastructure operators across EU member states to follow mandatory security rules, including OT/IT network segmentation and 24-hour incident reporting, although enforcement is uneven among thousands of smaller operators and older systems. All documented incidents hit systems that existing NIS2 security requirements would have protected.

CISA’s joint advisory recommends disconnecting unnecessary internet-facing remote-access interfaces, especially Virtual Network Computing on port 5900. When remote access is needed for operations, CISA says the interface should sit behind a VPN using strong authentication instead of being open to the public internet. The agency advises enforcing strong, unique credentials across all operational technology devices and changing every default password before any device connects to a network.

CISA recommends separating operational technology networks from IT networks and the public internet wherever that is operationally feasible. It also urges operators to audit internet-facing industrial control system exposure using Shodan and FOFA to see what is visible before attackers find it, and to use multifactor authentication whenever someone accesses operational technology remotely.

The Tureby water cooperative chose internet-connected hardware and left default credentials unchanged. It also had no network segmentation and no external audit. Those choices appear across thousands of small water utilities. At larger critical facilities, the same choices carry substantially greater consequences.

Denmark’s cyber espionage threat level for the telecom sector was raised from medium to high in March amid rising threats across Europe. In May 2023, SektorCERT reported Denmark’s biggest cyber attack on record, hitting critical infrastructure in two waves on May 11 and May 22, when 22 energy infrastructure companies were compromised, 11 immediately, through zero-day vulnerabilities in Zyxel firewalls. Experts believe multiple actors were involved, at least one attributable to Russia-linked Sandworm.

Cian Heasley, principal consultant at British cybersecurity firm Acumen Cyber, told Bloomberg he is astonished that no mass-casualty incident has happened yet, saying the groups can cause serious damage through malice or incompetence in volatile industrial environments. He said, “I am genuinely surprised we haven’t seen a catastrophe.” Simon Berner, lead cyber threat intelligence analyst at Estonia’s National Cyber Security Center, told Bloomberg that even with low sophistication, the more these groups probe, the more likely they are to find something critical that was poorly protected.

An October 2026 cyber attack on Dutch supermarket chain Albert Heijn disabled distribution centers and cleared shelves across the Netherlands and Belgium, and retail experts put operational losses above 10 million euros. Dutch police confirmed malicious action and filed a report, but formal attribution has not been announced. French supermarket refrigeration systems were also hit by a separate wave of cyber attacks during that period, and neither event has been formally linked to CARR or Z-Pentest.

An Associated Press database documented 147 Russian sabotage and disruption incidents across Europe. Norwegian officials said pro-Russian hackers carried out an April 2025 strike on the Bremanger dam, opening a floodgate and sending 500 liters of water each second for four hours. The dam is primarily used for fish farming, and Norwegian counter-intelligence chief Beate Gangås said the attack aimed to create fear and demonstrate capabilities rather than cause destruction.