Russian Cyber Attack on Muleshoe’s Water System: Expert Insight into Sandworm’s Capabilities and Motivations.

In January, a group of Russian hackers caused a small town in Texas called Muleshoe to experience a water tank overflow. The cyber-security firm Mandiant has identified the group responsible for this attack as Sandworm, a Russian hacking group known for their mature and dynamic approach to cyber threats. This was the first attack on public American infrastructure by the group, which was previously linked to various cyber attacks worldwide.

Security experts believe that Sandworm is likely connected to the Russian spy agency, GRU. While most state-backed threat groups typically specialize in specific areas of cyber attacks, Sandworm is unique in its ability to combine various capabilities into one comprehensive package. The hackers shared a video on Telegram demonstrating how they manipulated Muleshoe’s water system, overpowering it and resetting the controls.

In November 2020, US officials linked a separate attack on water systems in Pennsylvania to Iran. Ramon Sanchez, Muleshoe’s city manager, reported that the water tank overflowed for 30 to 35 minutes during the attack. The Cyber Army of Russia Reborn had claimed responsibility for this attack on their videos. The group has been linked to various cyber attacks worldwide, including on Ukraine’s power grid and the 2018 Olympic Games in South Korea. In 2020, the US Department of Justice charged six members of the group with crimes related to their cyber attacks, including disrupting the 2016 US presidential elections and creating a virus called NotPetya responsible for causing $10 billion in damage to computers globally.