Operational Technology & Industrial Security

Muleshoe, Texas — A Water Facility, a Third-Party Login

On January 18, 2024, the City of Muleshoe discovered its water system's SCADA had been compromised — through a third-party vendor's remote login system, per the City Manager's own statement — causing a storage tank to overflow. Two other Texas towns were targeted around the same time.

A hacktivist persona claimed credit and was linked by Mandiant to prior Sandworm (Russian GRU-linked) activity — but Mandiant explicitly could not confirm Sandworm's direct operational involvement in this specific attack. Most public reporting collapsed that distinction anyway.

Later development: On July 19, 2024, the U.S. Treasury sanctioned the leader and a primary hacker of Cyber Army of Russia Reborn (CARR), the hacktivist group that claimed the January 2024 tank overflows in Muleshoe and Abernathy. Treasury says the compromise of industrial control systems "resulted in the loss of tens of thousands of gallons of water." Its release does not name Sandworm or the GRU, and does not tie the two individuals to the Texas incidents specifically.

Dragos 2026: The Economics of OT Ransomware Changed

Dragos's 2026 OT Cybersecurity Year in Review (covering 2025 activity) tracked 119 ransomware groups targeting industrial organizations — up from 80 the year before. 3,300 industrial organizations were impacted; manufacturing accounted for more than two-thirds of victims.

The single most quotable finding: average detection time industry-wide was 42 days. Organizations with real OT-specific visibility contained OT ransomware incidents in an average of 5 days. Per Kiteworks's summary of the report, no specialized ICS malware was required — ordinary IT-side ransomware caused real OT consequences purely through interconnection. Dragos also notes OT devices running Windows often get misclassified as "IT only" by responders without OT expertise.