A water tower in Texas suddenly started overflowing. It may be the work of Russian hackers.

Kenneth Niemeyer
·2 min read
4

  • Russian hackers are suspected of causing a Texas town's water tank to overflow earlier this year.

  • Cybersecurity experts say the likely culprit is Sandworm, a Russian hacking group.

  • The US has also previously accused Sandworm of attacks in 2017 on hospitals in Pennsylvania.

In January, a Texas town's water tank suddenly started overflowing, spewing a torrent of water to the ground below.

The deluge was contained within an hour. But it's raising concerns this week, after the cybersecurity firm Mandiant said Wednesday that Russian hackers were likely behind it.

Mandiant, which is owned by Google, attributed the attack in Muleshoe, Texas to Sandworm, a Russian hacking group.

Mandiant called the group a "dynamic and operationally mature threat actor that is actively engaged in the full spectrum of espionage, attack, and influence operations."

Security experts said they believed the group was likely connected to the Russian spy agency, GRU. While most state-backed "threat groups" specialize in specific areas, like collecting intelligence or network sabotage, Sandworm stands alone in trying to unify each capability into one full package, Mandiant reported.

Hackers calling themselves the Cyber Army of Russia Reborn — a group that Mandiant linked to Sandworm — have claimed credit for the attack. They posted a video to Telegram of themselves manipulating Muleshoe's water system, showing how they overpowered it and reset the controls, according to The Washington Post.

If validated, this would mark the first attack on a public American infrastructure system by this group, according to the Post. US officials blamed Iran for a separate attack on water systems in Pennsylvania last November, according to CNN.

Ramon Sanchez, Muleshoe's city manager, told CNN that the city's water tank overflowed for about 30 to 35 minutes.

Authorities have previously blamed Sandworm, which has gone by different names over the years, for various attacks around the world, including on Ukraine's power grid and on the 2018 Olympic Games in South Korea.

In 2020, The US Department of Justice charged six members of the group with crimes related to its attacks, one of which it said was also involved in disrupting the 2016 US presidential elections.

The Justice Department also accused the men of creating a virus called NotPetya, which caused $10 billion in damage to computers worldwide, shutting down the power grid in Ukraine, and taking down the computer systems belonging to a chain of Western Pennsylvania hospitals.

Read the original article on Business Insider