Bloomberg: GRU-linked hackers spent two years sabotaging Western infrastructure

A Bloomberg investigation documented a two-year campaign by GRU-linked groups CARR and Z-Pentest to cause physical damage at Western facilities. Attacks exploited industrial controllers exposed online with VNC on port 5900 and default passwords like "1234", bursting water mains in Denmark, sparking factory fires in Spain and spoiling meat in the US.

• A burst main in Tureby, Denmark cut water to 450 homes; the password was "1234"
• At least three confirmed US incidents: a meatpacking plant, a Texas water system and a Pennsylvania waste plant
• In Spain attacks caused a transformer factory fire and halted two wineries
• A 2025 US DOJ indictment said CARR was directed by Russia's GRU