Hacktivists are shifting tactics, targeting OT systems for maximum disruption and media attention, while traditionally focused on website breaches and denial-of-service attacks, these groups are now exploiting vulnerabilities in critical infrastructure to amplify their messages, which is concerning because OT attacks can directly impact public safety.
Social media and news coverage create a feedback loop, encouraging further attacks as groups mimic successful strategies, where recent examples include coordinated attacks on water utilities with a mix of misinformation and actual disruption.
The anti-Israel hacktivist group CyberAv3ngers, active since 2020, targets operational technology (OT) from Israeli firm Unitronics, by using brute-force attacks and exploit default credentials to compromise programmable logic controllers (PLCs) and human-machine interfaces (HMI).
In November 2023, this tactic disrupted water treatment facilities worldwide, including manipulating a PLC in Pennsylvania and shutting down a water filtration plant in Ireland. These impactful attacks, despite some exaggerated claims, showcase their ability to exploit vulnerabilities in critical infrastructure.
Hacktivist groups are increasingly targeting industrial control systems (ICS) for geopolitical purposes, involving the CyberAv3ngers who defaced HMI systems with anti-Israel messages, potentially setting a precedent for future attacks.
Another group, CyberArmyofRussia_Reborn, is believed to be a state-sponsored proxy for APT28 and Sandworm, targeting broader infrastructure in support of Russian interests, which highlight the evolving tactics of hacktivists who are leveraging cyber intrusions to achieve political goals.
CyberArmyofRussia_Reborn, a hacktivist group, compromised Supervisory Control and Data Acquisition (SCADA) systems in water treatment facilities by exploiting vulnerabilities in Virtual Network Computing (VNC) to manipulate water tank controls.
Confirmed attacks in Texas and subsequent claims on Telegram indicate their capability and intent to disrupt critical infrastructure across US, France, and Poland, wihch suggests that the state-aligned group is using cyberattacks for retaliation, disrupting services, intelligence gathering, or masking other objectives.
According to Dragos, these attacks showcase the evolution of hacktivism towards organized targeting of critical infrastructure for geopolitical reasons.
Hacktivist group Blackjack targeted Moskollektor, a Russian infrastructure manager, in April 2024, where they allegedly used custom Fuxnet malware to disrupt sensor operations within the OT monitoring network, likely as a response to the ongoing geopolitical situation.
The vulnerabilities in Moskollektor’s system were specifically exploited by Fuxnet, which made it difficult to adapt the malware for implementation against other targets.
Blackjack claimed their attack went beyond sensor disruption, including compromising the emergency number, access cards, and online presences, by leaking data and malware source code to substantiate their claims.
The groups are evolving rapidly, with tactics progressing from exploiting basic vulnerabilities to deploying custom malware. The CyberAv3ngers compromised systems with default configurations, causing disruptions amplified by media.
Inspired by this, CyberArmyofRussia_Reborn used similar methods with more sophistication and achieved broader impact. Finally, Blackjack developed custom malware, highlighting a potential threat to critical infrastructure, demonstrating the growing technical capabilities of hacktivist groups.
Also Read: