Loading story…
U.S. officials stepped up warnings and coordination with industry over potential Russian cyberattacks tied to the Ukraine crisis, urging organizations to report signs of reconnaissance, exploitation testing, malware development, and compromises involving industrial control systems. The FBI, CISA, DHS, NSA, Treasury, Energy Department, and allied partners increased intelligence sharing and defensive preparations as officials cited the risk that destructive activity already hitting Ukrainian entities could spill over to U.S. and foreign companies with operations in Ukraine, particularly across energy, healthcare, finance, and other critical infrastructure sectors.
The concern was grounded in a documented history of Russian operations against operational technology and the energy sector. Prior U.S. government reporting detailed campaigns targeting critical infrastructure, while Treasury sanctioned a Russian state research institution linked to the Triton/Trisis malware used against Schneider Electric safety systems. The Justice Department later charged four Russian government-linked individuals over the Triton/Trisis and Dragonfly/Havex campaigns, alleging long-running efforts to compromise SCADA and industrial control environments at hundreds of organizations in roughly 135 countries to enable future disruption or physical damage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
On March 24, 2022, the Justice Department unsealed two indictments charging four Russian nationals linked to the Russian government for separate cyber campaigns targeting critical infrastructure and the global energy sector.
On 2022-03-01, CISA, the FBI, and the NSA issued a joint advisory warning critical infrastructure organizations about Russian state-sponsored cyber operations. The advisory detailed commonly exploited CVEs and TTPs, noted historical targeting of U.S. and international critical infrastructure including OT/ICS environments, and urged immediate defensive measures such as patching, MFA, logging, segmentation, and threat hunting.
A DHS intelligence bulletin dated January 23 assessed that Russia might consider cyberattacks on the U.S. homeland if Moscow believed a U.S. or NATO response over Ukraine threatened its long-term national security, while noting the threshold remained high.
On January 21, the FBI asked U.S. businesses to report any uptick in suspected Russian hacking threats, including testing of exploitation capabilities, malware development, and compromises involving industrial control systems or critical infrastructure.
The DOJ said an August 2021 indictment in the District of Kansas charged Pavel Akulov, Mikhail Gavrilov, and Marat Tyukov for Dragonfly intrusions targeting the global energy sector.
The DOJ said a June 2021 indictment in the District of Columbia charged Evgeny Viktorovich Gladkikh over the Triton-related conspiracy targeting critical infrastructure.
The U.S. Treasury sanctioned a Russian government research institution on October 23, 2020 for its alleged connection to the Triton malware used in the 2017 Saudi petrochemical plant incident.
The DOJ said that between February and July 2018, the Triton conspirators researched similar U.S. refineries and unsuccessfully attempted to compromise a U.S. company managing comparable critical infrastructure.
DHS publicly accused Russian government-backed hackers in 2018 of a multi-year effort to infiltrate U.S. energy, water, and manufacturing firms, including activity involving sensitive industrial control systems.
The DOJ alleged that between May and September 2017, Evgeny Gladkikh and co-conspirators hacked a foreign refinery and installed Triton/Trisis malware on Schneider Electric safety systems, causing two automatic emergency shutdowns.
The DOJ said the second Dragonfly phase ran from 2014 to 2017, focusing on specific energy-sector organizations and engineers through spearphishing and watering-hole attacks, including compromises affecting U.S. and international entities.
According to the DOJ, FSB-linked operators began the first Dragonfly/Havex phase in 2012, compromising ICS/SCADA manufacturers and software providers to distribute malware-laced updates and gain access to energy-sector networks.
The CNN report says Ukraine had faced a string of cyberattacks since mid-January, including destructive malware that wiped data from at least two Ukrainian government agencies.
Dragos' Robert M. Lee said a foreign hacking group identified as Xenotime/Temp.Veles conducted high-level reconnaissance against U.S. electric utilities operating liquefied natural gas facilities in December, without causing compromises.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourcecisa.gov
Open sourceedition.cnn.com
Open sourcehome.treasury.gov
Open sourcecisa.gov
Open sourcecrowdstrike.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities unsealed indictments against three **FSB** officers and one **TsNIIKhM** employee over long-running Russian state-sponsored cyber campaigns that penetrated energy-sector organizations and, in one case, deployed **TRITON** malware against a foreign oil refinery’s safety systems, forcing a shutdown. A joint **CISA**, **FBI**, and **DOE** advisory said the operations spanned 2011 to 2018 and included the **Havex** malware campaign, remote access to energy networks, theft of enterprise and ICS-related data, and activity consistent with operational preparation against critical infrastructure. Separate reporting and industry analysis tied related Russian-linked activity to **Energetic Bear**/**Dragonfly**/**TEMP.Isotope**, a cluster associated with intrusions into U.S. state and local government networks and earlier compromises of electric utilities and other critical infrastructure. Officials said some election-support IT systems were accessed in limited cases, but there was no evidence that vote tabulation systems, voting machines, or election data integrity were affected; defenders were urged to strengthen **IT/ICS segmentation**, apply patches, enforce **MFA**, restrict remote access, and follow established industrial control system guidance such as **NIST SP 800-82**.
Aug 15, 2026
Ukraine has remained a primary target and proving ground for Russian-linked cyber operations, from the **Petya/NotPetya** outbreak that began via Ukrainian networks and crippled government agencies, banks, transport systems, industrial firms, and Chernobyl monitoring systems, to later destructive malware planted in dozens of Ukrainian government and private-sector networks. Microsoft said the 2022 malware was discovered alongside website defacements affecting Ukrainian entities and appeared designed for later activation, while officials warned such activity could accompany broader military escalation. Earlier attacks on Ukraine’s power grid, election systems, and software supply chain underscored how repeated intrusions against the country have had consequences far beyond its borders. The campaign has also extended well outside Ukraine through espionage and supply-chain compromises attributed by officials and researchers to Russian state actors. Microsoft reported that hackers aligned with Russia targeted organizations in **42 countries** supporting Ukraine, with nearly two-thirds of espionage victims in NATO states and successful intrusions resulting in data theft in at least a quarter of cases. Separately, suspected **S.V.R.** operators were tied to a broad intrusion set affecting at least 40 organizations, including U.S. government agencies, technology firms, and cybersecurity companies, reinforcing warnings that attacks first seen in Ukraine can evolve into wider operations against allied governments and critical sectors.
Jun 29, 2026
Poland’s Internal Security Agency said hackers breached five water treatment plants and could potentially have taken control of industrial equipment, raising the risk of compromised water safety and possible physical harm. The incidents were disclosed alongside a wider warning that sabotage campaigns targeting Polish military sites, civilian entities, and critical infrastructure pose an immediate threat, while Sweden separately reported that suspected pro-Russian hackers attempted to disrupt a thermal power plant but were stopped by built-in protections. Officials in both countries described the activity as part of a broader pattern of increasingly aggressive attacks on operational technology across Europe, particularly against infrastructure in countries supporting Ukraine. In the United States, the disclosures add urgency to CISA’s new **CI Fortify** initiative, which tells critical infrastructure operators in sectors including water, energy, transportation, and communications to prepare to keep essential services running for **weeks to months** while isolated from business networks, vendors, and telecom providers. CISA said the program is designed for scenarios in which attackers may already have access to OT environments and foreign adversaries are prepositioned inside U.S. infrastructure, with guidance focused on isolating control systems, maintaining offline and manual operations, and rehearsing recovery through tested backups, documentation, and component replacement plans.
Jun 29, 2026