Threats · 153 days ago
The change is not another website outage. Russia-linked actors are moving from nuisance attacks against IT systems to attempts that can disrupt physical services, and that raises the stakes for any operator running industrial control or OT environments. A blocked attack still matters because the target was a heating plant, not a public-facing server.
Sweden said a pro-Russian group with ties to Russian intelligence tried to disrupt a thermal heating plant in western Sweden in spring 2025, and the attempt failed because built-in security protections worked. Officials said the same pattern is showing up across Europe, with similar pressure on energy and water systems in Norway, Denmark, Latvia, and Poland.
The forward risk is persistence, not novelty. If these groups keep targeting OT systems, the impact shifts from temporary digital disruption to possible loss of heat, water, or other civilian services, even when the initial intrusion is stopped.
3 sources covering this story
Sweden Blames Pro-Russian Group for Cyberattack Last Year on Its Energy Infrastructure
In what was Sweden’s first public mention of the attack, the country’s minister for civil defense said it targeted a heating plant in western Sweden.
Sweden blames Russian hackers for attempting 'destructive' cyberattack on thermal plant | TechCrunch
Sweden's minister for civil defense said Russian hackers are "now attempting destructive cyber attacks against organizations in Europe."
The Record from Recorded Future
Sweden says pro-Russian hackers attempted to breach thermal power plant
A suspected pro-Russian hacker group attempted to disrupt operations at a thermal power plant in western Sweden last year, a Swedish defense official said.
Part of the PlainSec briefing for 2026-04-16