Kremlin's Sandworm blamed for cyberattacks on US, European water utilities

The Russian military's notorious Sandworm crew was likely behind cyberattacks on US and European water plants that, in at least one case, caused a tank to overflow.

In a report today, Google's Mandiant threat-hunting team linked the intelligence outfit to disruptions at water and hydroelectric utilities earlier this year. This includes a series of attempts to disrupt Texas water facilities via remote-management software.

At least one of these intrusions caused a system malfunction, leading to a water tank overflow, Mandiant noted in its latest dossier [PDF].

Sandworm, which is understood to work for Russia's GRU military intelligence and is now labeled APT44 by Mandiant, has strongly supported the ongoing invasion of Ukraine.

This has included hitting Russia's neighbor with data-wiping malware, knocking out a segment of satellite comms terminals as well as mobile and internet services; stealing military secrets; and shutting down a Ukrainian power plant.

"Yet the threat posed by Sandworm is far from limited to Ukraine," Mandiant warned. 

The researchers said Sandworm operates the Telegram channels XakNet Team, CyberArmyofRussia_Reborn1, and Solntsepek, to draw attention to its activities and share any stolen data as it masquerades as some kind of independent hacktivist effort. Those channels mostly focus on causing chaos in Ukraine, though CyberArmyofRussia_Reborn1 has demonstrated it will go after Western targets, too.

"A majority of the attack-and-leak activity that Mandiant has tracked from GRU-linked Telegram personas has centered on Ukrainian entities," as the report put it. "However, CyberArmyofRussia_Reborn's claimed intrusion activity has not been so limited" and extends to US and European critical infrastructure organizations' operational technology (OT), Mandiant added. 

In January, CyberArmyofRussia_Reborn's Telegram channel claimed credit for disrupting human machine interfaces (HMI) controlling OT systems at Polish and US water utilities. Shortly after, city officials in Muleshoe, Texas, confirmed that someone compromised its water infrastructure equipment and caused a tank to overflow.

Similar attempts were made at systems in nearby towns, Abernathy and Hale Center, and city officials reportedly "determined the common link to be the vendor software they use that keeps their water systems remotely accessible," according to local news reports.

Then in March, the same Telegram gang posted another video and claimed it compromised the technology controlling water levels at a French hydroelectric facility, thus allowing the miscreants to disrupt electricity generation.

"We assess that changing Western political dynamics, future elections, and emerging issues in Russia's near abroad will continue to shape APT44's operations for the foreseeable future," Mandiant concluded. ®