CISA and FBI Warn of Pro-Russia Hacktivist Attacks on Critical Infrastructure Worldwide

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and international partners from the European Cybercrime Centre (EC3) have released a joint cybersecurity advisory detailing the escalating activities of pro-Russia hacktivist groups.

This new advisory highlights a shift in tactics, with hacktivists targeting Operational Technology (OT) and Industrial Control Systems (ICS) within critical infrastructure sectors in the United States, Europe, and globally.

The authoring organizations assess that these pro-Russia groups are conducting attacks that are generally less sophisticated than those of Advanced Persistent Threat (APT) actors but still pose significant risks.

Unlike state-sponsored APTs that may seek long-term espionage capabilities, these hacktivists employ opportunistic targeting methods.

Exploit minimally secured, internet-facing Virtual Network Computing (VNC) connections to infiltrate OT control devices.

The advisory warns that these groups capitalize on the widespread prevalence of accessible VNC devices to execute attacks that have resulted in varying degrees of impact, including limited physical damage.

The primary targets include the Water and Wastewater Systems, Food and Agriculture, and Energy sectors.

While many of the observed incidents involve “hack and leak” operations or defacement to garner publicity, the manipulation of Human-Machine Interfaces (HMIs) has led to operational disruptions.

Profile of Russian Hacktivist Groups

The advisory identifies several key groups responsible for these incidents, noting that while they claim to be independent hacktivists, many maintain direct or indirect ties to the Russian state.

Threat GroupOrigins & AffiliationKey Characteristics

Threat Group	Origins & Affiliation	Key Characteristics
Cyber Army of Russia Reborn (CARR)	Linked to GRU Unit 74455 (Sandworm); active since early 2022.	Originally focused on DDoS; expanded to ICS/OT attacks in late 2023. Documented intrusions into US and European utilities.
NoName057(16)	Created by the Kremlin-linked Center for the Study and Network Monitoring of the Youth Environment (CISM).	Uses proprietary DDoS tool DDoSia. Focuses on NATO member states. Collaborates closely with CARR.
Z-Pentest	Formed in Sept 2024 by admins from CARR and NoName057(16).	Specializes in OT intrusion operations and “hack and leak” campaigns. Avoids DDoS in favor of HMI intrusion claims.
Sector16	Emerging group formed in Jan 2025 via Z-Pentest collaboration.	Novice group sharing videos of US energy infrastructure compromises. Likely receiving indirect state support.

Technical Analysis and Mitigations

The technical analysis provided in the advisory indicates that these groups primarily utilize unsophisticated techniques to gain access.

Threat actors use open-source scanners to identify IP addresses with exposed VNC services on default ports (TCP 5900) or nearby ranges (5901-5910).

Once a target is identified, they employ brute-force password spraying to bypass weak authentication.

Upon gaining access to the HMI, the attackers manipulate the Graphical User Interface (GUI) to modify settings, turn off alarms, or change device parameters.

In several instances, the groups have documented their intrusions through screen recordings shared on social media channels to amplify their pro-Russia narrative.

CISA and its partners urge critical infrastructure organizations to implement immediate mitigations.

The primary recommendations include reducing the exposure of OT assets to the public internet, implementing strict network segmentation between IT and OT networks, and enforcing multifactor authentication (MFA) for all remote access.

Asset owners are also advised to update VNC software and change all default passwords on control devices immediately.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.