{ "id": "307487da-92c2-4a1d-83a7-20654415e6df", "created_at": "2026-04-06T00:17:29.972888Z", "updated_at": "2026-04-10T03:37:08.696977Z", "deleted_at": null, "sha1_hash": "a0cf2ccdfd2ec493e17862690ba783636dae6d85", "title": "Pro-Russian hackers blamed for water dam sabotage in Norway", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 3253266, "plain_text": "Pro-Russian hackers blamed for water dam sabotage in Norway\r\nBy Bill Toulas\r\nPublished: 2025-08-14 · Archived: 2026-04-05 15:01:14 UTC\r\nThe Norwegian Police Security Service (PST) says that pro-Russian hackers took control of critical operation systems at a\r\ndam and opened outflow valves.\r\nThe attack occurred in April and is thought to have been a demonstration of Russia’s ability to remotely hack critical\r\ninfrastructure in the country.\r\nAt the Arendalsuka annual national forum in the city of Arendal, the head of the PST, Beate Gangås, spoke about the\r\nincident saying that it was less of an attempt to cause damage than a display of what the hackers can do.\r\nhttps://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\n“They don’t necessarily aim to cause destruction, but to show what they are capable of,” stated Gangås during her talk about\r\nthe sabotage operation.\r\n“The purpose of these kinds of actions is to exert influence and create fear or unrest in the population,” the PST chief also\r\nstated, noting that Russia has become more dangerous.\r\nAccording to local media reports, the hackers compromised a digital system controlling the water flow at the Bremanger\r\ndam, and set the outflow valves to open position.\r\nIt took dam operators roughly four hours to discover and reverse the malicious valve setting. By that time, though, more\r\nthan 7.2 million liters (1.9 million gallons) of water had flown through.\r\nNorway’s National Criminal Investigation Service (Kripos) reached the same conclusion in June, based on videos that\r\nRussian hacktivists published on the Telegram messaging service to prove their intrusion.\r\nSpecifically, the hacktivists published a three-minute video showing the dam’s control panel, featuring a watermark\r\nassociated with a pro-Russian cybercriminal group.\r\nSuch acts have been previously associated with state-sponsored groups like Sandworm (APT44), and aimed at exaggerating\r\nimpact claims to create fear and uncertainty, and to publicly humiliate compromised organizations.\r\nThis is the second time Russia is associated with attacks against Norwegian entities, the previous one being a distributed\r\ndenial-of-service (DDoS) attack on the country’s state services.\r\nNorway’s Intelligence Chief, Nils Andreas Stensønes, stated that, while Norway is not at war with Russia, President Putin\r\nmaintains tension through hybrid attacks against the entire West.\r\nStensønes characterized Russia as an unpredictable neighbor and the biggest threat that Norway faces currently.\r\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nhttps://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/\r\nPage 3 of 4\n\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/\r\nhttps://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://www.bleepingcomputer.com/news/security/pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway/" ], "report_names": [ "pro-russian-hackers-blamed-for-water-dam-sabotage-in-norway" ], "threat_actors": [ { "id": "8941e146-3e7f-4b4e-9b66-c2da052ee6df", "created_at": "2023-01-06T13:46:38.402513Z", "updated_at": "2026-04-10T02:00:02.959797Z", "deleted_at": null, "main_name": "Sandworm", "aliases": [ "IRIDIUM", "Blue Echidna", "VOODOO BEAR", "FROZENBARENTS", "UAC-0113", "Seashell Blizzard", "UAC-0082", "APT44", "Quedagh", "TEMP.Noble", "IRON VIKING", "G0034", "ELECTRUM", "TeleBots" ], "source_name": "MISPGALAXY:Sandworm", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "7bd810cb-d674-4763-86eb-2cc182d24ea0", "created_at": "2022-10-25T16:07:24.1537Z", "updated_at": "2026-04-10T02:00:04.883793Z", "deleted_at": null, "main_name": "Sandworm Team", "aliases": [ "APT 44", "ATK 14", "BE2", "Blue Echidna", "CTG-7263", "FROZENBARENTS", "G0034", "Grey Tornado", "IRIDIUM", "Iron Viking", "Quedagh", "Razing Ursa", "Sandworm", "Sandworm Team", "Seashell Blizzard", "TEMP.Noble", "UAC-0082", "UAC-0113", "UAC-0125", "UAC-0133", "Voodoo Bear" ], "source_name": "ETDA:Sandworm Team", "tools": [ "AWFULSHRED", "ArguePatch", "BIASBOAT", "Black Energy", "BlackEnergy", "CaddyWiper", "Colibri Loader", "Cyclops Blink", "CyclopsBlink", "DCRat", "DarkCrystal RAT", "Fobushell", "GOSSIPFLOW", "Gcat", "IcyWell", "Industroyer2", "JaguarBlade", "JuicyPotato", "Kapeka", "KillDisk.NCX", "LOADGRIP", "LOLBAS", "LOLBins", "Living off the Land", "ORCSHRED", "P.A.S.", "PassKillDisk", "Pitvotnacci", "PsList", "QUEUESEED", "RansomBoggs", "RottenPotato", "SOLOSHRED", "SwiftSlicer", "VPNFilter", "Warzone", "Warzone RAT", "Weevly" ], "source_id": "ETDA", "reports": null }, { "id": "a66438a8-ebf6-4397-9ad5-ed07f93330aa", "created_at": "2022-10-25T16:47:55.919702Z", "updated_at": "2026-04-10T02:00:03.618194Z", "deleted_at": null, "main_name": "IRON VIKING", "aliases": [ "APT44 ", "ATK14 ", "BlackEnergy Group", "Blue Echidna ", "CTG-7263 ", "ELECTRUM ", "FROZENBARENTS ", "Hades/OlympicDestroyer ", "IRIDIUM ", "Qudedagh ", "Sandworm Team ", "Seashell Blizzard ", "TEMP.Noble ", "Telebots ", "Voodoo Bear " ], "source_name": "Secureworks:IRON VIKING", "tools": [ "BadRabbit", "BlackEnergy", "GCat", "NotPetya", "PSCrypt", "TeleBot", "TeleDoor", "xData" ], "source_id": "Secureworks", "reports": null }, { "id": "b3e954e8-8bbb-46f3-84de-d6f12dc7e1a6", "created_at": "2022-10-25T15:50:23.339976Z", "updated_at": "2026-04-10T02:00:05.27483Z", "deleted_at": null, "main_name": "Sandworm Team", "aliases": [ "Sandworm Team", "ELECTRUM", "Telebots", "IRON VIKING", "BlackEnergy (Group)", "Quedagh", "Voodoo Bear", "IRIDIUM", "Seashell Blizzard", "FROZENBARENTS", "APT44" ], "source_name": "MITRE:Sandworm Team", "tools": [ "Bad Rabbit", "Mimikatz", "Exaramel for Linux", "Exaramel for Windows", "GreyEnergy", "PsExec", "Prestige", "P.A.S. Webshell", "AcidPour", "VPNFilter", "Neo-reGeorg", "Cyclops Blink", "SDelete", "Kapeka", "AcidRain", "Industroyer", "Industroyer2", "BlackEnergy", "Cobalt Strike", "NotPetya", "KillDisk", "PoshC2", "Impacket", "Invoke-PSImage", "Olympic Destroyer" ], "source_id": "MITRE", "reports": null } ], "ts_created_at": 1775434649, "ts_updated_at": 1775792228, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/a0cf2ccdfd2ec493e17862690ba783636dae6d85.pdf", "text": "https://archive.orkl.eu/a0cf2ccdfd2ec493e17862690ba783636dae6d85.txt", "img": "https://archive.orkl.eu/a0cf2ccdfd2ec493e17862690ba783636dae6d85.jpg" } }