Low-skill pro-Russian hackers sabotage Western plants, water utilities — Bloomberg
Read NV on Google
Russian-backed saboteurs are increasingly hacking critical Western infrastructure (Photo: Reuters)
Russian-backed saboteurs are increasingly hacking critical Western infrastructure to trigger physical disasters, Bloomberg reported on Nov. 2.
The frequency of cyber intrusions yielding kinetic, physical consequences for industrial facilities is mounting rapidly across NATO member states, as the Kremlin increasingly enlists low-skilled hacktivists rather than elite GRU military intelligence units to conduct mass sabotage against civilian infrastructure and incite public panic, Bloomberg Businessweek wrote.
Incidents Across Alicante and Catalonia
Between late 2024 and the summer of 2025, Spain experienced an inexplicable string of industrial disruptions: cremation furnaces abruptly shut down in Alicante province, high-voltage renewable energy transformer equipment malfunctioned and sparked a fire at a Catalonia manufacturing plant, and climate control systems crashed across two separate commercial wineries. While facility owners initially presumed these events were isolated technical glitches, Spanish law enforcement later uncovered an orchestrated campaign.
Spanish police arrested 34-year-old Italian national Chris Barlati in Palencia. Barlati, an author of fringe conspiracy texts detailing a supposed "Masonic dictatorship," had sought asylum in the Russia and served as operational coordinator for an extremist cell tied to over 40 domestic attacks. The sabotage operations targeted municipal water pumping stations and industrial refrigeration plants, causing over $100k in property damage. Investigators confirmed the incidents formed part of a coordinated cyber-sabotage campaign run under the auspices of the Russian government.
The Kremlin’s Evolving Hybrid Playbook
Historically, digital attacks causing direct kinetic damage were exceedingly rare, typified by the 2010 Stuxnet worm and the 2014 cyberattack on a German blast furnace. Today, Moscow has institutionalized these physical sabotage techniques across 20 NATO nations. In August 2026, an explosive-laden unmanned aerial vehicle was uncovered at a German airport, an incident Berlin officials blamed directly on Moscow.
"What worries me most is the underestimated impact Russia has on our societies. Russia is on a path to destabilizing the entire political order across our European continent," German Chancellor Friedrich Merz declared.
Moscow provides ideological sympathizers with direct financial bounties and tactical operational support to sabotage wastewater treatment plants, hydroelectric installations, and factories. According to NATO Deputy Assistant Secretary General James Appathurai, the Alliance has observed an undeniable escalation in Russian hybrid aggression. France is drafting nationwide critical infrastructure defense contingency plans after hackers disabled refrigeration units across hundreds of commercial supermarkets in October, spoiling tons of food supplies.
The FBI Investigation and the Ukrainian Track
Certain participants in the cyber campaigns serve strictly ancillary administrative and propaganda functions. At the epicenter of a sprawling FBI investigation is 34-year-old Ukrainian national Viktoriya Dubranova, a native of Dnipro. A graduate of IT Step Academy, Dubranova posted Soviet imagery on social media and publicly opposed military mobilization before joining the "Cyber Army of Russia Reborn" (CARR), an entity managed on Telegram by a GRU handler operating under the moniker CYBER_ICE. The cell numbered roughly 100 active members, including minors, and commanded a following of 75,000 subscribers.
UK cybersecurity specialists at Acumen Cyber warned that the sheer recklessness and technical incompetence of these proxy saboteurs makes the risk of a catastrophic industrial accident exceptionally high. Dubranova designed digital promotional graphics, set attack videos to hard rock soundtracks, and brokered illicit compromised databases containing personal identifying information, driver's licenses, and passwords from thousands of citizens in Ukraine, Romania, and Moldova.
Operations conducted by CARR and affiliated outfit Z-Pentest include the digital sabotage of a Texas water utility, an operational failure at a Pennsylvania wastewater facility, unauthorized chemical tampering at a Colorado water site, and the shutdown of cold-storage units in Los Angeles that caused a hazardous ammonia leak requiring civilian evacuations. While attempting to escape into Russia with logistical assistance from Barlati and the FSB, Dubranova was apprehended by authorities in Poland. Extradited to the United States in December 2025, she faces over 30 years in federal prison.
Operating Under GRU Sponsorship
The amateurish, opportunistic signature of these cells was demonstrated in the Danish municipality of Tureby in December 2024. A Z-Pentest hacker infiltrated a local water pumping facility that relied on the default manufacturer password "1234," drastically elevated water pressure, ruptured subterranean water mains, and cut off municipal drinking water to 450 residential homes. Local water board chair Jan Hansen stated that the unauthorized remote meddling obliterated internal system controls.
In June 2025, Z-Pentest publicly declared a formal operational partnership with the GRU’s Sandworm cyber unit. The head of the cybercrime division of the Norwegian National Police, Atle Tangen, emphasized that the fundamental objective of these decentralized proxies is to terrorize civilian populations and erode institutional trust in government authorities. Intelligence officials note that pro-Russian hackers operate with blind opportunism, routinely boasting about breaching decoy "honeypots," as occurred when they compromised a simulated mock network of a Dutch water utility.
"Trying to catch us is like trying to catch the wind with a net. We have zero red lines," CARR spokesperson Yulia Pankratova told Bloomberg.
The military war may be swinging in our favor, but the information war continues.
Just as an army needs soldiers, so does a free society need its journalists to ensure that people have access to honest, trustworthy voices to understand the world around them.
For the past five years, The New Voice of Ukraine has been working tirelessly to push back against Russian narratives and defend democracy. But we cannot do it alone.
Please consider supporting us on Patreon for just $5 a month – your donation does directly to supporting journalists and ensuring that this front of the infowar says solid and defended.
Thank you.
Follow us on Twitter, Facebook and Google News
