Sweden Just Disclosed That Russia Tried to Destroy a Thermal Power Plant. Poland, Norway, Denmark, and Latvia Are Reporting the Same Pattern. Pro-Kremlin Hackers Are No Longer Just Doing DDoS. They Are Sabotaging Operational Technology That Keeps Heat, Water, and Power Flowing.

TL;DR

Sweden's civil defense minister Carl-Oskar Bohlin disclosed on April 15 that pro-Russian hackers with links to Russian intelligence services attempted a destructive cyberattack on a heating plant in western Sweden. The attack failed because security systems held. Bohlin explicitly called this "sabotage of our physical infrastructure" and noted a tactical shift from denial-of-service attacks against IT systems to destructive attacks against operational technology that controls physical functions. The Swedish disclosure follows coordinated cyberattacks on Polish combined heat and power plants in December 2025 affecting 500,000 customers, a Russian attack that opened a Norwegian dam valve, Danish water utility attacks leaving homes without water, and Latvian railway infrastructure arson. Seven days ago we covered CISA's warning that Iran was running the same playbook against American water systems, power grids, and government facilities. Two adversaries. Same target class. Two continents.

The takeaway

Same tactical shift.

European nations targeted

500K

Polish customers impacted (Dec 2025)

New target class (not IT)

Nation-states, same playbook

WHAT SWEDEN DISCLOSED

Carl-Oskar Bohlin, Sweden's minister for civil defense, held a press conference on April 15 and attributed a cyberattack on a heating plant in western Sweden to a pro-Russian group linked to Russian intelligence and security services. The Swedish Security Service investigated the incident and identified the actor. The attack failed because "the security systems in place worked." Bohlin did not name the targeted facility, but confirmed the aim was to disrupt the functioning of a facility that supplies heating.

The language Bohlin used matters. He described the attack as something that "can be likened to sabotage of our physical infrastructure." He noted that pro-Russian groups "that once carried out denial-of-service attacks are now attempting destructive cyber attacks against organizations in Europe." He specifically called out the shift from targeting IT systems to targeting operational technology, the "control systems which often control physical functions in various operations."

This is a Swedish government minister, speaking publicly, drawing a straight line between Russian intelligence services and an attempt to physically disrupt a facility that provides heat to Swedish citizens. The attribution is explicit. The characterization is sabotage. The context is wartime.

THE EUROPEAN PATTERN

Sweden's disclosure places this incident alongside a documented cluster of Russian critical infrastructure attacks across Europe. The pattern is now public record.

Poland, December 2025: Coordinated cyberattacks hit combined heat and power plants supplying heat to nearly 500,000 customers, plus wind and solar farms. Polish authorities later confirmed evidence that hackers were "directly linked to the Russian services."

Norway, August 2025: Pro-Russian hackers remotely opened a valve in a Norwegian dam, spilling millions of gallons of water before the attackers were expelled from the systems.

Denmark, 2024: Russian cyberattacks on a water utility left some homes without water. Disclosed publicly in December 2025.

Latvia, March 2026: The State Security Service reported that train and railway infrastructure had been set on fire by people acting in Russia's interests. The transition from cyberattack to physical sabotage is already complete in some operations.

Ukraine, January 2024: A cyberattack on a municipal energy company in Lviv left hundreds of apartments without heat for two days in freezing temperatures.

Sweden, now: Attempted destructive attack on a thermal power plant. Failed due to OT protection mechanisms.

THE IRAN PARALLEL

Seven days ago we published our analysis of CISA's joint advisory on Iranian targeting of US critical infrastructure. FBI, NSA, EPA, DOE, and US Cyber Command issued a coordinated warning that Iran-affiliated actors had been compromising internet-exposed programmable logic controllers at water utilities, wastewater systems, energy facilities, and government buildings. The targeted devices were the same category Bohlin described in Sweden: operational technology control systems that manage physical processes.

These are not unrelated stories. They are the same tactical shift executed by two different adversaries against two different sets of targets on two different continents. Russia is targeting European critical infrastructure to coerce NATO members supporting Ukraine. Iran is targeting American critical infrastructure amid conflict with Israel and its allies. The operational pattern is identical: find internet-exposed control systems, compromise the devices that manage physical processes, attempt destructive or disruptive effects.

For anyone operating water utilities, power facilities, or heating infrastructure in the United States, the Swedish disclosure is not foreign news. It is a preview of the threat model you are already inside.

WHY OT IS THE NEW BATTLEFIELD

The shift from IT to OT is strategically deliberate. Denial-of-service attacks against corporate websites cause inconvenience. They do not cause physical harm. They do not force governments to respond. They do not create political pressure. Destructive attacks on operational technology do all three. A water utility that cannot deliver water affects tens of thousands of homes. A heating plant that fails in winter creates life-safety conditions. A dam valve that opens unexpectedly threatens downstream communities.

The attackers have figured out that the traditional line between "cyber" and "physical" has dissolved. A programmable logic controller is a computer. It is also a thing that opens valves, regulates pressure, and controls temperature. Compromise the computer, and you control the physical system. The facility you are protecting is no longer a network. It is a building that runs on networked control systems that were designed decades ago without meaningful security in mind.

This is why Bohlin's language was so specific. Pro-Russian hackers have moved from the IT perimeter to the OT perimeter. That perimeter is thinner, older, and protects things that actually matter to daily life.

WHAT THIS MEANS FOR US OPERATORS

1
If you operate a water utility, wastewater system, power facility, or industrial control environment in the United States, assume you are a target. The CISA Iran advisory from April 9 and the Swedish Russia attribution this week are bookends on a threat landscape that spans adversaries. The tactical details differ. The target class does not.
2
Inventory your internet-exposed OT devices. The Swedish attack and the Iran campaign both targeted control systems that could be reached from the internet. A programmable logic controller that should only be accessible from an internal engineering workstation should not respond to a scan from the public internet. If you cannot produce this inventory, Censys or Shodan almost certainly can, and so can your adversary.
3
Verify the built-in protection mechanisms Bohlin credited with stopping the Swedish attack. In ICS environments, these are typically safety instrumented systems (SIS), interlocks, and physical overrides that prevent control systems from executing commands that would cause damage. These safety layers are your last line of defense when the cyber layer is already compromised. If they are not tested, maintained, and understood by your operators, they cannot save you.
4
Separate your IT and OT networks. This is the most frequently ignored piece of guidance in industrial cybersecurity and the single most important control. If your corporate email compromise can reach your control systems through flat network architecture, the adversary who phishes your accountant owns your valves.
5
Engage with your local InfraGard chapter, WaterISAC, or E-ISAC for sector-specific threat intelligence. The indicators of compromise, tactical details, and mitigation guidance relevant to your sector are shared through these channels. If you are not receiving that intelligence, you are flying blind on a threat landscape where Russia, Iran, and China are actively operating.

ATARUS ASSESSMENT

One week ago American intelligence agencies said Iran was targeting US water and power infrastructure. This week Sweden said Russia tried to destroy a heating plant. Between those two disclosures, we covered the Anodot supply chain leak, the Patch Tuesday AI volume crisis, and the Anthropic Mythos model that finds zero-days in every major operating system. These stories are not parallel tracks. They are converging pressures on a defensive ecosystem that was not designed for this level of sustained, coordinated, multi-adversary targeting. The water district in California, the heating plant in Sweden, and the power utility in Poland are all defending against the same tactical shift with different national response frameworks. For everyone operating critical infrastructure in the United States, the most important lesson from Bohlin's disclosure is this: the attack failed because the safety systems worked. The safety systems worked because someone designed them, maintained them, and tested them. That is the defense. Nothing else will save you once an adversary with nation-state backing is inside your control network.