Russian attack on a Norwegian hydroelectric power plant
Russian attack on a Norwegian hydroelectric power plant#### These are the figures from the first cyberattack that Norway officially attributed to Russia. On April 7, 2025, pro-Russian hackers remotely controlled the valves of the Bremanger dam — all because of a weak password.
Welcome in Security Sunday, you will find information about this attack, as well as a look at a new threat to all password managers, an Apple zero-day vulnerability, and a massive data leak from Orange Belgium.
On April 7, 2025, a critical infrastructure security breach occurred when pro-Russian hackers gained control of a dam in Bremanger, western Norway. This attack marks the first time Oslo has officially attributed a cyberattack to Russia.
From a technical standpoint, the attackers were able to remotely control the dam’s valves for four hours, during which time they released water at a rate of 500 liters per second. In total, nearly two million liters of water were released before the attack was discovered and stopped. The attackers gained remote access to the dam’s SCADA systems and were able to manipulate the release mechanisms.
According to the technical management of the company operating the dam, the attackers probably gained access to the system due to a weak password. This trivial vulnerability, combined with likely insufficient network segmentation, allowed hackers to gain access to the most critical systems.
Although there were no injuries or serious material damage due to the low water level in the river, the consequences could have been catastrophic. In addition, the attackers published a three-minute video with a watermark of a pro-Russian cyber group on Telegram on the same day as the attack, which served as a “proof of concept” and a psychological operation aimed at demonstrating their capabilities.
In light of this incident, it is necessary to reevaluate the approach to critical infrastructure security. The Norwegian Security Service has issued specific recommendations, including the use of strong passwords, regular software updates, and the separation of control systems from the internet.
New type of attack on password managers
In August 2025, security researcher Marek Tóth presented a new attack technique called DOM-Based Extension Clickjacking at DEF CON 33, which threatens tens of millions of password manager users worldwide. This sophisticated attack can steal login credentials, two-factor authentication codes (TOTP), and credit card details directly from the browser extensions of popular password managers. Unlike traditional phishing attacks, which rely on tricking users with fake websites, this technique exploits the legitimate functionality of extensions and bypasses common security defenses.
DOM-Based Extension Clickjacking is an advanced variant of classic clickjacking that directly manipulates DOM elements inserted by extensions into web pages. While traditional clickjacking uses transparent frames to hide malicious elements, this new technique can dynamically detect the presence of a password manager and deploy a specific exploitation strategy for each type of extension.
The practical execution of the attack is alarmingly simple and effective. The malicious website creates a blocking element such as a cookie banner or CAPTCHA and simultaneously inserts an invisible form with transparency set to 0.001. Using the JavaScript function focus(), the form field is activated, which automatically triggers the password manager’s dropdown menu. Crucially, the DOM manipulation also makes the extension’s user interface invisible, so when the user clicks on a seemingly innocent element (such as “Reject cookies”), they actually activate the extension’s invisible dialog. The form is then automatically filled in, and the attacker obtains all sensitive data without the victim’s knowledge.
Protection against this attack requires a combination of measures on the part of both users and developers. Users should immediately enable automatic updates for their password manager extensions and check that they are using the latest versions. As a temporary measure, it is recommended to disable autofill features and set extension access in Chromium browsers to “On click” instead of “On all websites.”
Apple has fixed a critical zero-day vulnerability in iOS 18.6.2
On August 19, 2025, Apple released an emergency security update, iOS 18.6.2, which fixes an actively exploited zero-day vulnerability, CVE-2025–43300.
Technically, this is an out-of-bounds write issue in the ImageIO framework, which is responsible for processing image formats in iOS and iPadOS systems. The vulnerability allows attackers to cause memory corruption when processing a specially crafted image file, which can lead to application crashes or remote code execution.
According to an official statement, Apple has confirmed that the vulnerability has been exploited in extremely sophisticated attacks against specific targeted individuals. Attackers implemented zero-click attacks, where the malicious payload is launched automatically without user interaction via text messages, emails, or messaging apps.
CVE-2025–43300 is the seventh zero-day vulnerability that Apple has fixed in 2025.
Cyberattack on Orange Belgium: 850,000 customers affected
Telecommunications giant Orange Belgium has fallen victim to a large-scale cyberattack that affected 850,000 Belgian customers. The incident took place at the end of July 2025 but was not made public until August 19.
The attackers gained access to sensitive personal data, including names, phone numbers, SIM card information, and PUK codes. Fortunately, passwords, email addresses, and financial data were not compromised, which partially limited the extent of the potential damage. However, the information obtained still poses a significant security risk — in particular, the combination of SIM numbers and PUK codes could allow attackers to carry out SIM swapping attacks, in which they take control of victims’ phone numbers and gain access to their accounts protected by two-factor authentication.
Orange Belgium responded in accordance with standard procedures, immediately blocking access to the compromised system, strengthening security measures, and beginning to notify affected customers.
In 2025, Orange Group faced a series of cyberattacks affecting various branches, including France, Romania, and Spain.