Pro-Russia Hacktivists Conduct Opportunistic Attacks Against Critical Infrastructure

Hacktivists

Hacktivist Campaign VNC Exploitation OT/ICS Targeting

Overview

Pro-Russia hacktivist groups, including Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated entities, have been conducting opportunistic attacks against critical infrastructure systems worldwide. These groups exploit internet-facing, minimally secured Virtual Network Computing (VNC) remote access connections to gain unauthorized access to operational technology (OT) control devices. The campaigns are opportunistic rather than highly sophisticated, relying on scanning for weak or default credentials and poorly configured remote access systems. Despite their relatively low sophistication, these attacks pose significant risks to critical infrastructure operations.

Technical Specifications

Attribute	Details
Threat Actors	Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16
Campaign Type	Opportunistic Hacktivist Operations
Attack Vector	Network (Internet-facing VNC services)
Authentication	Weak/Default credentials, No authentication
Complexity	Low to Medium
Target Systems	OT/ICS, HMI devices in critical infrastructure
Initial Access Method	VNC remote access exploitation

Affected Infrastructure

Critical Infrastructure Sectors: Energy, utilities, water, manufacturing, transportation
Target Systems: Human-Machine Interfaces (HMIs), OT control devices, SCADA systems
Affected Organizations: US and global critical infrastructure operators with internet-exposed VNC services
Geographic Scope: Global, with focus on US and allied nations
Device Types: Industrial control systems with VNC remote access enabled

Technical Details

Techniques & Methods Observed

Internet-wide Scanning: Systematic scanning for VNC and other remote access services exposed to the internet
Credential Attacks: Use of weak, default, or no passwords to gain unauthorized access
Brute Force Tools: Running password brute-force and spraying tools from temporary VPS instances
Credential Harvesting: Logging and recording credentials and IP addresses for connected HMI/OT devices
Direct OT Access: Gaining access to Human-Machine Interfaces and other OT components via VNC
Temporary Infrastructure: Use of disposable VPS instances to avoid attribution

Tactics, Techniques, and Procedures (TTPs)

Reconnaissance: Scanning for exposed VNC services on critical infrastructure networks
Initial Access: Credential brute force, default credential reuse, and authentication bypass
Protocol Exploitation: Leveraging VNC and similar remote protocols for initial access
Lateral Movement Potential: Using compromised access to explore connected systems
Publicity Operations: Self-attribution and amplification of successful intrusions on social platforms

Attack Scenario

Reconnaissance: Threat actors conduct internet-wide scans to identify publicly accessible VNC services connected to OT/HMI systems in critical infrastructure environments
Initial Access: Attackers use brute force attacks or exploit default/weak credentials to authenticate via VNC to OT control systems
Establish Access: Once authenticated, actors interact directly with control interfaces of operational technology systems, including HMIs and SCADA components
Potential Disruption: Attackers manipulate control settings, alter operational parameters, or cause unintended operational conditions in physical processes
Self-Attribution/Amplification: Threat actors publicize or exaggerate their access and impact on social media platforms and Telegram channels for propaganda purposes

Potential Access Points

Internet-exposed VNC services on port 5900 and related ports
Poorly configured remote access gateways
OT networks without proper network segmentation
HMI systems with default or weak authentication
Legacy industrial control systems lacking security controls

Impact Assessment

IntegrityConfidentialityAvailability

Unauthorized modification of operational parameters
Manipulation of control settings in industrial processes
Alteration of setpoints and thresholds
Potential sabotage of physical systems

Exposure of network topology and OT architecture
Harvesting of credentials for OT systems
Access to sensitive operational data
Intelligence gathering on critical infrastructure

Operational disruption of critical services
Process interruptions and downtime
Potential safety incidents due to improper control
Service degradation affecting customers

Mitigation Strategies

🔄 Immediate Actions

Asset Discovery: Identify all internet-facing OT assets and remote access services immediately
VNC Audit: Locate all VNC and remote desktop services accessible from the internet
Exposure Reduction: Remove or firewall public internet exposure for OT assets
Credential Review: Change all default credentials and weak passwords on OT systems
Emergency Segmentation: Isolate critical OT systems from internet-facing networks

🛡️ Network Security

Internet Exposure Elimination: Remove or reduce public internet exposure for OT assets
Network Segmentation: Segment OT from IT networks to reduce lateral movement and contain breaches
Firewall Implementation: Deploy firewalls between OT and IT zones with strict allow-list policies
VPN Requirement: Require VPN access for any remote connectivity to OT systems
Demilitarized Zones: Implement DMZ architecture for any necessary external access points

🔒 Authentication & Access Control

Strong Authentication: Implement strong passwords (no defaults) for all OT access points
Multi-Factor Authentication: Deploy MFA where technically feasible on remote access systems
Privilege Management: Apply least-privilege principles to OT system access
Access Review: Regularly review and revoke unnecessary remote access permissions
Account Management: Disable unused accounts and services on OT devices

📊 Monitoring & Detection

Access Logging: Monitor and log all access to VNC and similar remote services
Anomaly Detection: Deploy monitoring for unusual access patterns or times
Credential Monitoring: Alert on failed authentication attempts and brute force indicators
Configuration Monitoring: Review and strengthen device configuration and setpoint alerts
Network Traffic Analysis: Monitor OT network traffic for suspicious connections

Threat Intelligence

Known Threat Actors

Cyber Army of Russia Reborn (CARR): Pro-Russia hacktivist group targeting critical infrastructure
Z-Pentest: Hacktivist collective conducting opportunistic OT attacks
NoName057(16): Known for DDoS and opportunistic intrusion campaigns
Sector16: Affiliated hacktivist group targeting Western infrastructure
Related Groups: Various pro-Russia hacktivist collectives and offshoots

Indicators of Compromise (IOCs)

Scanning activity targeting VNC ports (5900, 5800, 5901, etc.)
Failed authentication attempts from foreign IP addresses
VPS provider IP addresses connecting to OT systems
Unusual access times or geographic locations
Concurrent access to multiple OT devices from same source

Resources and References

Official Documentation

Critical Warning

While these attacks are considered less sophisticated compared to advanced persistent threats (APTs), the impact on critical infrastructure can still be significant — especially when systems controlling physical processes are affected. The opportunistic nature means any organization with internet-exposed OT systems is at risk.

Security Best Practice

For critical infrastructure OT security:

Never expose OT systems directly to the internet
Eliminate default credentials on all industrial devices
Implement defense-in-depth with multiple security layers
Segment OT networks from IT and internet-facing systems
Deploy continuous monitoring with OT-aware detection
Test incident response procedures specific to OT environments
Coordinate security between IT and OT/engineering teams