Cyber ​​Siege: How Hackers Target the World’s Infrastructure

July 25, 2026



Power plants, dams, water stations, transit systems and a medical-device maker were all hit by cyber operations in 2025 and 2026. Governments in Europe and the U.S. blame Russia and Iran for most of them. The pattern is real, but the earlier version of this story mixed confirmed facts, company claims and a few numbers I could not trace to any source.

This rewrite checks each incident against government statements, security-vendor reports and reputable news coverage. It separates what is established from what is claimed, and it flags three entries in the original that were not cyberattacks at all. For defenders, the common thread is dull but useful: most of these succeeded through weak passwords, exposed management interfaces and missing approval controls.

Quick summary

  • Poland’s grid (December 29–30, 2025): A destructive attack on about 30 distributed energy sites caused no blackout. ESET and Dragos pointed to Russia’s Sandworm. In July 2026 the UK and EU formally blamed a different unit, the FSB’s Centre 16.
  • Sweden: A failed attempt on a thermal plant in spring 2025, announced on April 15, 2026.
  • Los Angeles Metro (March 2026): An Israeli firm says Iran’s intelligence ministry was behind a “hacktivist” persona. Trains and buses kept running.
  • FortiBleed: A credential-theft campaign, not a new vulnerability. Over 86,000 working credentials were reported, and the FBI says it is still active.
  • Stryker (March 11, 2026): Attackers used Microsoft Intune’s own wipe command. About 80,000 devices were reportedly erased, versus 200,000 claimed by the group.
  • Norway’s dam (April 2025): A valve was opened for about four hours. The extra flow caused no damage.
  • Not cyberattacks: The Ukraine energy figures in the earlier text describe missile and drone strikes, and the UK section is a warning, not an incident.

Europe’s energy and water systems

Poland’s power grid

On December 29 and 30, 2025, attackers hit two combined heat and power plants and a system that manages renewable generation, according to the Polish government as reported by The Hacker News. ESET named the data-wiping malware DynoWiper and attributed it to Sandworm, a Russian military-intelligence group, with medium confidence. Its endpoint product blocked the wiper in at least one case, and ESET knew of no successful disruption.

Dragos took a different view of the damage. It said the attackers breached about 30 distributed-energy sites, in the first major attack aimed at that kind of asset, and disabled key equipment beyond repair at some sites, as The Hacker News summarized. Dragos assessed the activity with medium confidence as ELECTRUM, which overlaps with Sandworm. It called the operation opportunistic, and noted every affected site sat below the size threshold for mandatory cybersecurity rules, per Industrial Cyber.

The original text said the UK Foreign Office attributed the attack to the FSB’s Centre 16 and presented that as the same story. It is not the same. On July 13, 2026 the UK and EU states formally attributed the attack to FSB Centre 16 and said it could have cut power to 500,000 people in winter. Vendors had pointed to the GRU-linked Sandworm months earlier. Nobody has publicly reconciled the two. Moscow rejects such attributions.

Sanctions package, July 13, 2026

The EU listed nine individuals and four entities, and the UK listed 24, in the first simultaneous cyber-sanctions package, as the Register and others reported. Those named included Z-Pentest, a pro-Russia hacktivist group, and two people tied to CARR (Cyber Army of Russia Reborn), according to the EU Council’s statement.

Sweden’s thermal plant

Civil defence minister Carl-Oskar Bohlin said on April 15, 2026 (not June, as the earlier text had it) that a pro-Russian group tried to disrupt a thermal plant in western Sweden in spring 2025. The attempt failed, and Sweden’s security service identified an actor with connections to Russian intelligence, TechCrunch reported. The plant was not named. The Russian ambassador called the allegations unfounded.

Norway’s dam

On April 7, 2025, attackers opened a valve at a dam in Bremanger, Norway, for nearly four hours. This was a minimum-flow pipe at a dam used mainly for fish farming, and the extra flow was about 497 liters per second, with no consequences, the dam’s manager told industry press. The earlier text’s “opened its floodgates” overstated it. Investigators found a video of the control panel watermarked by a pro-Russian group. Norway’s security service blamed pro-Russian hackers in August 2025, the first time Oslo formally attributed a cyber incident to Russia, per Reuters via Arctic Today. Russia’s embassy called that politically motivated.

Water systems in Poland and Denmark

Poland’s internal security agency (ABW) reported in its May 6, 2026 publication that attackers breached water stations in five towns in 2025. In some cases they could alter equipment parameters, via management interfaces reachable from the internet with weak passwords, The Record reported. ABW blamed hacktivist groups, often fronts for foreign intelligence, particularly Russian; it did not name a specific group. Some secondary sources named APT28 and APT29, which I could not confirm in ABW’s own wording.

In Denmark, Z-Pentest accessed a waterworks in Køge in December 2024 and Danish defense intelligence formally attributed the attack in December 2025. A reported pressure manipulation burst three pipes. I could not verify the original text’s Quebec water-plant claim, so I removed it.

Iran-linked operations in the U.S.

Los Angeles Metro

LA Metro found unauthorized activity in mid-March 2026 and shut down parts of its network. It said bus and rail service ran uninterrupted, per SecurityWeek. A group calling itself Ababil of Minab claimed the attack. On May 26, Israeli firm Gambit Security said the persona was unlikely to be a new standalone crew and tied it to infrastructure used in an earlier campaign that Israel’s National Cyber Directorate attributed to Iran’s intelligence ministry, per TechCrunch.

That is one security firm’s assessment, not a U.S. government attribution that I could find. The group’s name refers to the Minab school strike, which TechCrunch said killed more than 175 people. Claims that attackers reached a system that monitors trains came from the group’s own posts, and LA Metro said safety systems kept running. The “700 GB stolen” figure comes from one aggregator and I treat it as unverified.

Stryker

On March 11, 2026, the medical-technology company Stryker confirmed a “global disruption” to its Microsoft environment. The Handala group, which security vendors link to Iran, claimed the attack. A source told BleepingComputer the attackers used a compromised administrator account to send Intune remote-wipe commands to roughly 80,000 devices between 5 and 8 a.m. UTC. Handala claimed over 200,000 systems and 50 TB of stolen data, per BleepingComputer. Those larger numbers are the group’s claims.

CISA warned U.S. organizations on March 18 to harden endpoint-management tools, including requiring a second administrator’s approval for wipes. The earlier text said Stryker was hit “because Multi-Admin Approval was not enabled.” Some blogs say so, but other reporting says Stryker has not disclosed whether it was on. I treat it as unconfirmed. The claim that the attack framed itself as reprisal for the Minab strike is Handala’s own framing.

FortiBleed

FortiBleed is not a vulnerability. Security firm SOCRadar reported a verified database of 86,644 working administrator and VPN credentials for FortiGate devices across 194 countries as of June 19, 2026. Other analyses gave 74,000 to 75,000 devices, per SecurityWeek. Fortinet attributes it to reused credentials, brute force and missing multi-factor authentication, per Industrial Cyber. The actor is described as a Russian-speaking initial access broker, which means someone selling access to others, with overlaps to the INC and Lynx ransomware operations.

Two caveats. The “about half of all internet-facing Fortinet firewalls” figure is a vendor estimate. And the original’s “at least four organizations fully compromised, including government” line was not something I could verify. Update: the FBI and Secret Service warned in early October 2026 that the campaign remains active and that some victims may be locked out of devices, per The Hacker News.

Things that were not cyberattacks

  • Ukraine’s grid. The earlier text cited “1,225” attacks in 2025 and $20 billion in damage. I could not find those figures. The Ukrainian numbers I did find, for example about 3,000 attacks since March 2025 per the energy ministry, count missile and drone strikes. The Sandworm and Danish-energy sentence also referred to an earlier incident, so I removed it.
  • The UK. GCHQ director Anne Keast-Butler said in a May 27, 2026 speech that Russia is “relentlessly targeting” critical infrastructure and subsea cables, per AP. That is a warning, not an attack on the grid.
  • ZionSiphon. Darktrace analyzed a sample whose targeting list names Israeli water and desalination facilities. Its researchers found flaws in the targeting logic that suggest it was unfinished, and I found no report tying it to a named Iranian group, so I dropped the attribution to APT35, MuddyWater and CyberAv3ngers. Details are in SecurityWeek’s summary.

Claim check

Claim Status Note
Polish grid attack, December 2025ConfirmedDecember 29–30; no outage.
Attributed to SandwormVendor, medium confidenceESET and Dragos.
Attributed to FSB Centre 16Government, July 13, 2026Conflicts with the vendor attribution; unreconciled.
Sweden announcement in June 2026WrongApril 15, 2026.
LA Metro hit by Iranian intelligenceOne firm’s assessmentGambit Security; no U.S. attribution found.
FortiBleed: 86,000+ devicesVendor figureSOCRadar; others say about 75,000.
FortiBleed is a Fortinet flawNoCredential reuse and brute force.
Stryker: 80,000 vs 200,000 devices80,000 reported; 200,000 claimedHandala claims the higher figure.
Stryker lacked Multi-Admin ApprovalUnconfirmedStryker has not said.
Norway “floodgates” openedOverstatedA minimum-flow valve; no harm.
Ukraine: 1,225 attacks, $20BUnverifiedKinetic strikes, not cyberattacks.

My take

I haven’t investigated these incidents myself. These views come from reading the reports.

  • Attribution is moving slower than the headlines. The Poland case shows two credible answers, a military unit and a security-service unit. I’d wait for the underlying evidence before treating either as settled.
  • The scary part is mostly mundane. Weak passwords, exposed management interfaces and a single admin account were behind water-plant, Fortinet and Stryker incidents alike. The Polish grid sites were also small enough to fall outside the rules.
  • One criticism of the “siege” framing: several incidents failed or caused no outage, and some headline numbers come from the attackers or vendors. The risk is real, but it doesn’t help to inflate it.

What this means for you

  • Take management interfaces off the internet. The Polish and Danish water breaches came through internet-reachable management interfaces with weak or default passwords.
  • Rotate credentials on exposed firewalls. If you run FortiGate, follow CISA’s guidance: end active sessions, reset credentials, turn on phishing-resistant MFA, restrict management access and look for unknown admin accounts.
  • Require two-person approval for destructive actions. In Intune, turn on Multi Admin Approval for wipes, scripts and role changes, and protect Global Administrator accounts with phishing-resistant MFA.
  • Cover small sites. Distributed energy and water sites often fall outside regulation. Treat remote terminal units like any other exposed device and keep offline backups.
  • Don’t trust a claimed number. If you write or brief on these events, label vendor and attacker figures as such.

FAQ

Did hackers cause a blackout in Poland?

No. The December 2025 attack caused no outage, though Dragos says it permanently disabled some equipment at affected sites.

Is FortiBleed a Fortinet vulnerability?

No. It is a credential-harvesting campaign relying on reused and weak passwords, brute force and missing MFA.

Who attacked Stryker?

The Handala group claimed it. Security vendors link the group to Iran’s intelligence ministry. I did not find a formal government attribution.

Sources

Tags

You Might Like

Show more
Hacking Stories & Breaches

Post a Comment

0Comments

Post a Comment (0)
Share to other apps
Copy Post Link