Cyber sabotage, Russian spies, and AI's moral dilemmas: Best infosec long reads 10/31/26

Happy spooky Halloween Saturday to all!

Full access to Metacurity's curated infosec long reads is available to paid subscribers. Our goal is simple: make it financially viable to keep investing the time and expertise required to find, vet, and contextualize the most important security journalism each week. Free readers will still get highlights, but subscribers will get the complete, deeply curated set.

10/31/2026: This week’s long reads explore how Russia-linked hackers are turning cyberattacks into physical sabotage, a GRU spy’s break-in at an African Union diplomatic residence, why AI benchmarks are failing to measure what models can actually do, whether AI can be trained to behave virtuously, and how Ukrainian scammers are weaponizing fraud against Russia.

Inside the Cyber Sabotage Campaign Waged by Russian Supporters

Bloomberg's Ryan Gallagher explains how Russia-linked hacktivist groups are escalating to physically destructive attacks against water utilities, factories, refrigeration systems, and other critical infrastructure across NATO countries and the US, exploiting poorly secured industrial controls despite often lacking sophisticated technical skills.

Historically, cyberattacks that inflict physical damage have been rare events. There have been a handful of high-profile examples, such as the 2010 attack on an Iranian nuclear enrichment facility widely attributed to the governments of the US and Israel, and a 2014 attack carried out by unknown hackers on a steel mill in Germany that caused catastrophic damage to a blast furnace. Russia’s marquee hacking groups, operating inside agencies such as the Main Directorate of the General Staff of the Armed Forces of the Russian Federation, or GRU, have conducted espionage and at times carried out complex attacks like those that shut down Ukraine’s power grid in 2015.

But the attacks in Spain, along with similar incidents that took place on a seemingly random assortment of targets in about 20 countries, most of them NATO members, were something different. Russia’s encouragement and, sometimes, financial and operational support of sympathetic hackers have been well documented. These ostensibly independent actors damage websites they see as unfriendly to President Vladimir Putin’s regime, publish stolen data and gum up social media with propaganda. Law enforcement agencies in multiple countries determined that what they have been seeing more recently is a version of this approach that employs far more serious tactics. A loose collection of hackers has been more or less wandering around the internet, poking at systems in countries deemed hostile to Russia and trying to cause as much harm as possible. The result was hundreds of attacks on water treatment plants, factories, hydroelectric dams and other sensitive locations.

The attacks seem designed to cause damage and sow fear while falling short of actual combat, which affords its state sponsors a measure of plausible deniability. Since Russia’s full-scale invasion of Ukraine, Europe has been experiencing a steady increase in such incidents, which have included crude parcel bombings and arson attacks. “My biggest concern is the underestimated Russian impact on our societies,” German Chancellor Friedrich Merz told Bloomberg in October. “Russia is on the way to destabilize the entire political order of our European continent.”

German officials have blamed Russia for an incident in August when a drone carrying an explosive device was found at an airport, a charge Russia has denied. In September, French President Emmanuel Macron warned that France, too, was facing intensifying hostile actions from Russia and said he’d instructed his government to prepare a plan to protect critical infrastructure and the defense industrial and technological base against drone and cyberattacks. In October, hackers were able to disable refrigeration systems in hundreds of French supermarkets for about six hours, spoiling large amounts of food. Investigators have not determined whether there was any Russian involvement.

“We see a clear escalation in the part of Russia carrying out hybrid attacks, including sabotage,” says James Appathurai, NATO’s deputy assistant secretary-general for innovation, hybrid and cyber. In late September, the Danish Defence Intelligence Service said it expected Russia to intensify its efforts, and that this “could include destructive cyber attacks that cripple critical societal functions as well as sabotage attacks that carry a high risk of casualties.” Representatives of the Russian government did not respond to requests for comment for this article.

Two arrests related to the spate of cyberattacks illustrate the challenge of stopping them. According to police, the man arrested in Spain, Chris Barlati, was acting as a facilitator for the hackers, helping to run their communication channels and select targets. They also say he attempted to help Victoria Dubranova, a Ukrainian woman who’d allegedly been involved in similar activities, escape to Russia. In December 2025, US law enforcement officials announced she’d been arrested and extradited to the US. Dubranova is set to become one of the only people ever to face trial in the US for alleged involvement in this kind of campaign. She has pleaded not guilty. Members of the group responded with angry posts on social media, while also mockingly claiming such actions would have little impact on their ability to continue operating.