GRU-backed CARR cyberattack on Los Angeles meat processing facility — ammonia leak and mass food spoilage

In November 2024, members of CyberArmyofRussia_Reborn (CARR) — an organization the US Justice Department states was "founded, funded, and directed by the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU)" — accessed the industrial control systems of an unnamed meat processing facility in Los Angeles County and manipulated process parameters, spoiling thousands of pounds of meat and causing an ammonia leak at the facility. The attack followed CARR's documented operational technique, described in CISA advisory AA25-343A (December 10, 2025): scanning public IP ranges for open VNC ports, connecting to HMI devices with default or brute-forced passwords through a temporary VPS, and issuing process commands directly through the HMI interface without deploying any malware. The advisory characterizes CARR's technical capability as limited and its attacks as haphazard, in the sense that members frequently misunderstand the industrial processes they are trying to disrupt, making physical consequences unpredictable rather than precision-engineered. The incident entered the public record when the DOJ unsealed an indictment on December 10, 2025 against Victoria Eduardovna Dubranova, charged with supporting both CARR and the related pro-Russia group NoName057(16). The coordinated CISA advisory, co-signed by CISA, FBI, NSA, and international partner agencies, documented the broader CARR campaign as having caused damage to controls and the spilling of hundreds of thousands of gallons of drinking water at US water and wastewater systems in the same operational period. Treasury had previously sanctioned CARR leadership members Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko in July 2024.

Thousands of pounds of meat spoiled; ammonia leak triggered at an unnamed Los Angeles County meat processing facility in November 2024. Industrial ammonia refrigeration systems are a recognized OT process safety exposure class: an attacker who can access the HMI controlling the refrigeration environment can trigger ammonia venting, compressor over-runs, or valve failures, creating both a product-loss event and a potential life-safety hazard. Financial impact and recovery duration were not publicly disclosed.