Muleshoe Texas water tank overflow (Sandworm-linked CARR)

On January 18, 2024, a remote-access industrial-software interface at the Muleshoe, Texas municipal water system was compromised, and the attacker manipulated a tank-level process variable to induce an overflow lasting between 30 and 45 minutes. City officials detected the overflow, removed the affected device from the network, and switched to manual operations. A Telegram channel operating as the Cyber Army of Russia Reborn (CARR) claimed responsibility and posted video of the attack. On the same day, similar suspicious activity was observed on the SCADA system at the City of Lockney (75 miles east of Muleshoe), and the City of Hale Center recorded 37,000 firewall login attempts over four days. In April 2024, Mandiant publicly attributed the CARR Telegram channel to Sandworm (GRU Unit 74455), noting overlapping infrastructure and account behavior. Mandiant subsequently expanded this attribution in its July 2024 APT44 deep-dive. None of the three Texas towns reported drinking-water quality or supply impact to customers. The incident is the most widely cited US municipal-water OT manipulation event in the 2020s outside of the Aliquippa CyberAv3ngers compromise.

Tank overflow at Muleshoe (no customer water-quality impact reported); probing at Lockney and Hale Center; sector-wide CISA and EPA alerts; reinforcement of EPA / CISA water-utility-cybersecurity briefings to state primacy agencies.