In January, a small town in Texas called Muleshoe experienced a water tank overflow due to an attack by a group of Russian hackers. This was a concerning incident as it targeted US infrastructure. The cyber-security firm Mandiant identified the group responsible for this attack as Sandworm, a Russian hacking group known for their mature and dynamic approach to cyber threats.
Sandworm has been linked to various cyber attacks worldwide, including on Ukraine’s power grid and the 2018 Olympic Games in South Korea. In 2020, the US Department of Justice charged six members of the group with crimes related to their cyber attacks, including disrupting the 2016 US presidential elections. The Justice Department also accused the group of creating a virus called NotPetya, responsible for causing $10 billion in damage to computers globally.
The hackers referred to themselves as the Cyber Army of Russia Reborn in the videos they shared on Telegram, demonstrating how they manipulated Muleshoe’s water system. They overpowered it and reset the controls, causing it to overflow for 30 to 35 minutes during the attack. Ramon Sanchez, Muleshoe’s city manager, reported that this was the first time an American public infrastructure system had been targeted by Sandworm.
Many security experts believe that Sandworm is likely connected to the Russian spy agency GRU. While most state-backed threat groups typically specialize in specific areas of cyber attacks, such as intelligence gathering or network sabotage, Sandworm is unique in its ability to combine various capabilities into one comprehensive package. The video shared by Sandworm showcased their technical expertise and demonstrated their willingness to engage in espionage, attacks
