Welcome back, aspiring cyberwarriors!

We’re continuing our series on SCADA hacking. Today, we’re going to walk through a compromised SCADA system controlling several water towers belonging to a company in Russia. The company was compromised by Cyber Cossacks. The group was trained by OccupyTheWeb to defend Ukraine digitally. Along with the water towers, they gained access to a range of SCADA systems within the organization, from refrigerators to pasteurization systems.

System administrators rarely segment SCADA systems from Active Directory and that helps hackers move laterally once they compromise a vulnerable host. Even though this particular company didn’t have a properly configured AD, the group still managed to compromise all the hosts through password reuse. This example should be useful for both blue and red teams. Let’s take a closer look.

Initial Access

It began with access to a database system. The IT team had made some effort to isolate the machine and none of the local credentials were useful anywhere else. There were no cleartext credentials in the registry, PowerShell history or local files. The host was used for development and maintenance of the company’s database, which was outsourced to a third party provider.

The team used Inveigh to capture NTLMv2 hashes when users tried to connect to nonexistent shares. This tool is similar to Responder, but it works on Windows.

Windows automatically tries to authenticate with the host it thinks is hosting the share, sending NTLMv2 credentials along the way. Once captured, these can be cracked offline later. The image above was pulled from the internet to show what this looks like.

Cracking Hashes

After collecting hashes, they ran hashcat against rockyou.txt. A few passwords cracked, giving them access to an accountant’s machine. That became their pivot. The accountant had local admin rights and after dumping local SAM hashes, the group got the Administrator hashed password, which turned out to be reused across multiple machines and SCADA servers running on Windows 7.

Windows 7 Vulnerabilities

Windows 7 is outdated and lacks the security measures newer systems have, yet it’s still common in SCADA environments. Without LSASS memory dump prevention (LSASS PPL), pulling credentials from it is easy. Using NetExec they dumped LSASS and got the Administrator’s actual password.

Inside the SCADA Server

They used RDP to connect to the SCADA server. It had dashboards showing refrigerators and milk pasteurization systems with visual representations of the system status.

They also found schematics built by the engineering team, like the one below with visual layouts of the system operations.

MasterSCADA

MasterSCADA is a common SCADA management application used across different Russian companies. It often has a default “sa” user and a blank password. This system was no different.

Water Tower Access

The water towers were the most interesting find in this operation. They were part of the same SCADA system. The executives had pictures of the physical towers and their drainage pond. The SCADA interface showed pressure and temperature stats.

As mentioned in Part 1, hacking SCADA isn’t always about destroying the Windows machine it’s hosted on. Hackers need to understand how the system actually works. Research is key here. When you’re dealing with water towers and pipe networks, pushing pressure to the maximum is rarely safe. Most water systems are designed to run between 2 to 4 bar (30 to 60 psi). Spiking the pressure to 5 bar can cause serious damage. Weak pipes might burst, fittings and joints can start leaking and plastic components will just fail under this stress.

At night the risks get even higher, because the demand is low. A pressure increase followed by a valve closing or a pump shutting off can create a water hammer. That pressure wave travels through the system and damages valves at the very least.

That’s what happened here. The group raised the pressure to its maximum and left it there. By the time the facility resumed work in the morning, the pressure had been sitting at critical levels for several hours. This kept happening for several days, causing significant damage before the group wiped everything.

Conclusion

SCADA systems aren’t always secured. Often they aren’t segmented and don’t have unique credentials. From a single foothold, the group moved laterally and compromised the entire organization. Ironically, the vulnerable SCADA server helped the hackers do it without any resistance. SCADA is more than just software, as it connects the physical and digital worlds. Mishandling it can bring real and visible consequences.

If you want to learn how to hack and secure SCADA systems, we invite you to our training led by OccupyTheWeb. It’s available for both beginners and advanced students.

The post SCADA Hacking: Inside Russian SCADA/ICS Facilities, Part 2 first appeared on Hackers Arise.

Russian hackers from the TA488 group exploited a Zimbra webmail flaw triggered when emails were opened or previewed, stealing credentials and up to 90 days of messages from victims.

Welcome back!

This is the final article of our Drone Warfare series on Ukraine’s rise as a drone powerhouse. But Ukraine’s success story is not one it achieved alone. The country’s drone industry was built with the support of partners from around the world who helped Ukraine during its most difficult times. Here we look at Ukraine’s export strategy and how it can serve as a way to give back by sharing hard-earned battlefield experience and technology with the nations that helped make this success possible.

Battlefield Experience

For most of the war, Ukraine’s drone sector existed on the demand side of the defense market. The country needed huge volumes of FPV drones, interceptor drones and reconnaissance systems simply to keep pace with the battlefield. By 2026, that position began to change. Ukraine started to present itself not only as a state that needed drones, but as a state that could supply them, co-produce them, and teach others how to use them. In March 2026 President Volodymyr Zelenskiy discussed joint arms production with Dutch Prime Minister Rob Jetten and said Ukraine was ready to export interceptor drones that are not needed on its own battlefield.

Ukraine is not trying to sell a platform developed in peacetime and polished for foreign buyers. It is offering weapons and systems that were shaped by daily combat against a technologically capable enemy. That gives Ukrainian exports a different value proposition. They are presented as battlefield-tested tools that have already survived the hardest possible proving ground.

The Export Model

Ukraine’s export strategy depends on the fact that it is producing more than it can immediately absorb on the front line in certain categories, especially interceptor drones. In June 2026 Ukraine said it could produce 2,000 interceptor drones per day, with about half potentially available beyond domestic needs, and that it could supply at least 1,000 interceptor drones a day to allies facing Shahed attacks if investment improves. That is the logic behind the export conversation. Ukraine is not opening the floodgates on every weapon it makes. It is identifying categories where production has moved beyond immediate domestic consumption.

Business Insider also reported that Ukraine wants to protect its own security first and only share technologies that do not compromise its battlefield position. That means exports are likely to focus on systems that are already partially superseded on the Ukrainian front, or on systems that can be co-produced under controlled conditions.

Europe

Europe is the most obvious destination for Ukraine’s export strategy because the continent is already moving in Ukraine’s direction. The Netherlands are going to spend €248 million on drones for Ukraine, with production split between the Netherlands and Ukraine. On 17 June 2026 the Netherlands pledged another €500 million for drones and air defense equipment. These are signs that European governments are beginning to fund drone production as an industrial activity.

The broader European defense picture points the same way. It was reported that G7 countries and the United States had agreed to allow Ukraine-based and European firms to produce long-range missiles and air defense systems under license. Europe is no longer only buying Ukrainian results, it wants to buy into the production model behind them.

The broader European defense market is also moving in Ukraine’s direction. For instance, Airbus partnered with the French counter-drone startup Alta Ares. Under the June 2026 memorandum of understanding, Airbus will integrate Alta Ares’ AI-guided interceptors, including the Black Bird and X-Lock systems, both combat-tested in Ukraine since 2024, into its Fortion IBMS command-and-control platform, connecting Alta Ares’ targeting software and interceptor drones to Airbus’ battle management systems to create a sensor-to-shooter chain against drone and cruise missile threats.

Middle East

The Middle East is the second major market because it faces a different but equally urgent drone threat. In March 2026 Zelenskiy said Ukraine was ready to send instructors to the Middle East and export interceptor drones that are not needed at home. Business Insider added that Ukrainian officials see older Ukrainian counter-drone technology as still useful for allies facing Shahed attacks, even if those systems are already outdated by Ukraine’s own battlefield standards. A weapon does not need to be the newest model to be valuable if the user’s threat environment is less intense than Ukraine’s.

That makes the Middle East a natural fit for Ukraine’s export model because the buyer often wants a system, not just a drone. The package includes interceptor drones, training, radar integration, and electronic warfare resilience. Zelenskiy explicitly framed the issue that way, saying that without radar coverage and software that can operate under jamming, an interceptor is not a real defender.

Production

The most interesting part of Ukraine’s export strategy is not the sale itself. It is the move toward co-production. The point of co-production is to make exports more durable and less vulnerable to disruption. It also lets allies develop industrial capacity while Ukraine keeps access to the newest combat-tested designs. The G7 agreement reported by The Guardian shows a model where production can be shifted into partner territory while still drawing on Ukrainian experience and requirements. That approach helps solve three problems at once. It spreads risk away from the battlefield. It makes procurement faster for partners. And it creates a legal framework for sharing sensitive technology without handing over full control of the most advanced systems.

The Financial Logic

The export strategy also has a budget logic. Drone exports and co-production can help bring in foreign money, expand industrial capacity, and reduce pressure on the domestic defense budget. The Netherlands’ funding would support drones and air defense equipment for Ukraine, while Ukraine’s officials see export volume as a way to unlock more production capacity. The practical idea is that external orders help keep factories busy, while revenue and investment help scale the next generation of systems.

This logic is important in wartime because the domestic state cannot fund every possible expansion on its own. Exports make production more sustainable. They also let Ukraine distribute risk across several partners rather than relying only on its own budget and wartime aid flows. In other words, the export strategy is partly about money, but it is also about industrial resilience.

Main Constraints 

Ukraine’s export strategy is still tightly constrained by its own security needs. Ukrainian officials want to keep priority for domestic forces and treat exports as selective. That means the country is not trying to become a free-market weapons bazaar in the middle of a war. It is trying to manage surplus capacity without weakening the front line. There is also the issue of sensitivity. Not every system can be exported, and not every partner can receive the same level of access. Licensed production in allied countries solves part of that problem, but only part. The more advanced the system, the more likely it is to remain under stricter Ukrainian control. That is why the export strategy is likely to be layered. That means some hardware is going to be sold directly, while some systems will be co-produced, some software and training will be shared for integration, and some capabilities will stay in-house.

Strategic Value

Ukraine’s biggest advantage in the export market is not price alone. It is combat credibility. Allies are interested because Ukraine’s drones and counter-drone systems were developed in the harshest possible environment. A state that has spent years fighting under heavy electronic warfare pressure, missile strikes, and mass drone attacks has something to offer that many peacetime defense industries do not. That does not mean Ukraine will dominate global drone exports. Competition is still strong, and certification with production security all remain real obstacles. But the country has already crossed an important threshold, where it’s no longer only asking for help. It is now a partner that can supply systems, share production, and train others to fight the same kind of war.

Conclusion

Europe wants production. The Middle East wants interception. Ukraine wants revenue and industrial depth. That creates a new model built around selective exports and battlefield-tested expertise. Ukraine is no longer only defending itself with drones, but it is using drone expertise to build alliances. That is the meaning of its export strategy today.

The post Drone Warfare: Ukraine’s Drone Industry, Part 3 – Export Strategy first appeared on Hackers Arise.