Russian Hackers Attacked Norwegian Dam

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, Norway said Russian hackers open a dam flood gate, Spain is defying pressure to eject Huawei and a cyberattack against the Office of the Pennsylvania Attorney General. Hackers leaked stolen North Korean Kimsuky data, Microsoft patched a Kerberos zero-day and a hacker struck it rich with a Chrome security bug bounty.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

An official from the Norwegian Police Service said Wednesday that Russian hackers in April took remote control of a flood gate controlling water flow in a dam at Risevatnet in Bremanger, a municipality in western Norway.

PST chief Beate Gangås said water flowed through the dam for four hours, letting through nearly 500 liters per second, reported tabloid newspaper Verdens Gang. Gangås spoke at a public conference dedicated to hybrid warfare, during which Nils Andreas Stensønes, head of the Norwegian Intelligence Service, said that Russia is the country’s biggest threat.

The incident did not cause any injuries or flooding. Norway shares a 123-mile border with Russia, which has become more assertive in Northern Europe following its February 2022 invasion of Ukraine. The Kremlin has ramped up its use of so-called hybrid tactics, including hacking and sabotage, in a bid to unsettle European countries and undermine support for Ukraine. British foreign intelligence service head Richard Moore in a rare November 2024 speech accused Russia of “a staggeringly reckless campaign of Russian sabotage in Europe.”

Stensønes in September said that intelligence agencies predicted Russia would intensify acts of sabotage against critical infrastructure such as oil and gas. Norway uses hydropower to generate the majority of its electricity.

Threat intel firm Mandiant in April 2024 attributed a cyberattack against a water tank in the Texan town of Muleshoe to the Russian nation-state threat actor commonly known as Sandworm, which is Unit 74455 of the Main Intelligence Directorate. The attack caused the tank to overflow after hackers claimed to have gained access to the water utility’s human machine interface (see: The Global Menace of the Russian Sandworm Hacking Team).

The Spanish government acknowledged Tuesday that Chinese telecom equipment maker Huawei is an advisory member of a government advisory center dedicated to 5G cellular network security.

The admission, reported by El País, comes as Spain faces pressure from the United States, the European Commission and civil society not to proceed with a 12.3 million euro contact awarded by the Ministry of the Interior in July to Huawei to store legally intercepted communications.

Huawei’s role in the 5G security operations center is strictly advisory, comparable to the roles of other equipment manufacturers including Ericsson and Nokia, officials from the Ministry of Digital Transformation told El País.

National daily newspaper ABC reported Monday that U.S. Director of National Intelligence Tulsi Gabbard gave Spain until Aug. 31 to cancel the contract or face strict limits in intelligence sharing. Spain is the sites of two U.S. military bases.

Huawei is on a number of Western blacklists, fueled by concerns that the Chinese manufacturer poses a national security risk. The U.S. Federal Communications Commission in 2023 banned sales of new Huawei equipment. Individual members of the European Union including Germany and France have ordered telecoms to rip out Huawei equipment. The European Commission in January 2020 classified Huawei as a “high risk” supplier subject to potential restrictions.

Spanish President Pedro Sánchez has struck a different tone and Spain is not among the trading bloc members to restrict Huawei sales to telecoms. His government defended the Huawei contract, emphasizing that the contract is for high-end servers – specifically OceanStor 6800 V5 servers – and not for data management. Huawei has told media that it products “in the Spanish market comply strictly with local laws and norms.”

Sánchez met with Chinese leader Xi Jingping in Beijing in September, during which his office said he “conveyed the desire to continue deepening bilateral relations on the basis of mutual respect and recognition.”

The Office of the Pennsylvania Attorney General confirmed a cyberattack that disrupted its network, taking down the agency’s website, email accounts and landline phone services. Attorney General Dave Sunday announced this week that staff are working with law enforcement to investigate the incident and restore operations.

Officials did not identify those responsible although the scale of the disruption is consistent with a ransomware incident. No group has claimed responsibility.

Security researcher Kevin Beaumont previously reported that multiple Citrix NetScaler appliances on the Attorney General’s network were exposed to CVE-2025-5777, the vulnerability also known Citrix Bleed 2. Beaumont said that one device went offline July 29 and another on August 7.

The Shadowserver Foundation reported Monday that over 3,300 Citrix NetScaler devices remain vulnerable to CVE-2025-5777. The U.S. Cybersecurity and Infrastructure Security Agency added on July 10 the flaw to its known exploited vulnerabilities catalog (see: Attackers Actively Exploit ‘Citrix Bleed 2’ Vulnerability).

As of publication, the Pennsylvania Attorney General’s website is back online with a warning about delays.

North Korean hacking group Kimsuky suffered a data leak after hackers “Saber” and “cyb0rg” claimed responsibility for stealing and publishing the group’s data online. The pair, speaking through an address published in the latest issue of Phrack at Def Con 33, said they acted for ethical reasons.

The leaked 8.9 gigabyte dataset is hosted by Distributed Denial of Secrets and contains Kimsuky’s internal tools, stolen data and source code for South Korea’s Ministry of Foreign Affairs email platform. It also includes phishing records tied to military and government domains, live phishing kits, malicious binaries, Cobalt Strike loaders and evidence of VPN purchases and hacking forum activity.

While some of the exposed information was already known, the release provides connections between tools and targets, offering fresh intelligence into the group’s activities. The long-term operational impact on Kimsuky remains uncertain, though the breach may cause short-term complications and force adjustments to their campaigns.

Microsoft’s August Patch Tuesday delivered fixes for 107 vulnerabilities, including a publicly disclosed zero-day in Windows Kerberos tracked as CVE-2025-53779. 13 of the flaws are rated critical, comprising nine remote code execution, three information disclosure and one privilege escalation issues.

Yuval Gordon of Akamai uncovered the Kerberos flaw in May, which stems from a relative path traversal issue. The flaw enables an authenticated attacker with specific control over delegated managed service account attributes msds-groupMSAMembership and msds-ManagedAccountPrecededByLink to escalate privileges to a domain administrator.

Microsoft also warned about CVE-2025-53786, a vulnerability in Exchange hybrid deployments that could allow attackers to escalate privileges and gain administrative access to cloud-based environments (see: Microsoft Warns of Hybrid Exchange Deployment Flaw).

Google paid a record $250,000 bug bounty to security researcher “Micky” for uncovering a critical remote code execution vulnerability in Chrome that enabled attackers to bypass sandbox protections. The flaw was in Chrome’s Inter-Process Communication Zone system, specifically in the Transport::Deserialize function.

This granted unauthorized access to duplicate sensitive browser process handles, enabling a full sandbox escape. The attack involved sending crafted requests, including RelayMessage calls with specific handle ranges, to extract privileged handles such as thread handles, which could then allow arbitrary code execution with elevated privileges.

Google fixed the flaw and is reviewing the patch rollout across all Chrome versions. The payout is among the largest in Chrome’s history.

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey and David Perera in Northern Virginia.