On 27 October 2026, Bloomberg Businessweek published a feature by Ryan Gallagher reporting that cyberattacks causing physical damage are rising in North Atlantic Treaty Organization (NATO) countries, and that the pro-Russia sympathizers carrying them out do not always understand what they are doing. Bloomberg described a series of incidents in Spain from late 2024 into the summer of 2026. Crematorium ovens at a funeral home in the province of Alicante suddenly stopped working. Machinery for manufacturing renewable-energy transformers at a factory in Catalonia malfunctioned and caused a fire. At two wineries, heating and ventilation systems in production and storage areas drove temperatures up. According to Bloomberg, the owners first assumed they were dealing with technical glitches.
In July, El Confidencial reported that the Spanish National Police, working with the Federal Bureau of Investigation (FBI), arrested a 34-year-old suspect in Palencia in March 2026. According to El Confidencial, investigators link him to the pro-Russia groups Cyber Army of Russia Reborn (CARR), Z-Pentest and NoName057(16). The actions he is alleged to have been involved in include shutting down cold storage rooms at a factory in Zaragoza, with losses of about 170,000 euros, blocking the smart irrigation system in the gardens of the City of Arts and Sciences in Valencia, changing fermentation tank controls at a winery, changing chlorine dosing in water treatment, stopping the motors at a drinking water reservoir in the Canary Islands, and disabling crematorium ovens at a funeral home. These remain allegations and have not been proven in court.
Who the actors are. The governing guidance is the joint Cybersecurity Advisory AA25-343A, "Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure." It was released by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) with more than twenty partners, including the Spanish Civil Guard, the Spanish National Police and the United Kingdom National Cyber Security Centre (NCSC-UK). The joint advisory names four groups, CARR, Z-Pentest, NoName057(16) and Sector16, along with affiliated groups. It describes them as less sophisticated than state hacking teams, mainly seeking notoriety, and often making false or exaggerated claims. It also says some of these groups have had direct or indirect support from the Russian state, and that they have willfully caused real harm, including physical damage, in the water, food and agriculture, and energy sectors.
How they get in. According to the joint advisory, these groups look for human-machine interface (HMI) screens, the operator panels used to run a process, that can be reached from the internet through virtual network computing (VNC), a common remote screen-sharing tool, and that have default, weak or no passwords. Once connected, they change whatever the screen allows, such as setpoints, limits, alarms, device names and passwords. No software vulnerability is needed.
What is new. The groups and their methods are not new. What is new is the pattern of physical outcomes now being reported at sites that are far from the usual critical infrastructure list: a funeral home, wineries, a cold storage plant, a transformer factory and public garden irrigation. The joint advisory warns that because these actors do not understand the processes they touch, they cannot predict what their changes will do, and that their attacks on occupied factories and community facilities show a lack of consideration for human safety.
What it means for plant owners. If you run a small manufacturing plant, a food and beverage operation, a winery, a water system or a building with automated heating, cooling and refrigeration, you may not think of yourself as a target. These groups do not pick targets by importance. The joint advisory calls their targeting opportunistic, which means they go after whatever they can reach. An exposed remote screen with a weak password is enough, and because the person on the other end does not understand your process, the outcome is unpredictable. A changed temperature setpoint, a disabled alarm or a stopped pump can quickly become a safety problem and not just a production problem. On Red Tiger assessments, the exposed screen is often one the plant staff did not know about, installed by an integrator or equipment vendor for remote support through a cellular modem or a small remote access box.
What the Red Tiger team recommends:
If something changes on its own and nobody on shift made the change, treat it as a possible incident and not a glitch. In the United States, report it to CISA at contact@cisa.dhs.gov or 1-844-SAY-CISA, or to your local FBI field office. Elsewhere, report it to your national computer emergency response team (CERT).
With 500+ assessments across critical infrastructure, the Red Tiger Security team helps owners find exposed remote access with plant-safe methods, set up secure vendor access, and confirm that safety limits live in the controller and not just on the screen.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Sources:
Bloomberg Businessweek, Ryan Gallagher, "Russia-Linked Hackers Are Turning Cyberattacks Into a Physical Threat," 27 October 2026: https://www.bloomberg.com/news/features/2026-10-27/russia-linked-hackers-are-turning-cyberattacks-into-a-physical-threat
El Confidencial, 13 July 2026: https://www.elconfidencial.com/espana/2026-07-13/espana-hacker-policia-fbi-ciudad-artes-tanatorio-agua_4386748/
Joint Cybersecurity Advisory AA25-343A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a (PDF: https://www.cisa.gov/sites/default/files/2026-08/aa25-343a-pro-russia-hacktivists-conduct-attacks_0.pdf)
Check out our resources and book a follow-up call with our team.
