Summary Points
- The pro-Russian hacktivist group TwoNet shifted from DDoS attacks to targeting critical infrastructure, notably a fake water treatment plant used as a honeypot for observation.
- In September, they gained initial access via default credentials, exploited an XSS vulnerability, and disrupted operations by altering PLC setpoints and disabling logs without escalating privileges.
- TwoNet’s activities extend beyond DDoS, targeting HMI/SCADA systems in “enemy countries,” and publishing personal and cybercrime service details, indicating a broader shift to operational technology (OT) attacks.
- Forescout advises critical infrastructure organizations to strengthen authentication, segment networks, and deploy protocol-aware detection to defend against such sophisticated cyber threats.
Key Challenge
Recently, a pro-Russian hacktivist group called TwoNet shifted its tactics from launching targeted DDoS attacks against entities supporting Ukraine to actively probing critical infrastructure, specifically targeting a water treatment facility. However, this particular attack was a controlled simulation— a honeypot set up by cybersecurity researchers from Forescout to monitor and analyze hacker behavior. On September 26, TwoNet gained initial access to the decoy system by exploiting default credentials and a known cross-site scripting vulnerability, quickly moving from entry to attempting disruptive actions within just over a day. They created a fake user, bypassed security checks, disabled logs, and manipulated control systems, all while remaining unaware they were engaging with a mock environment. Forescout tracked their activities, including attempts to target SCADA systems, while warning that such groups are expanding their operations to include attacks on operational technology (OT) and industrial control systems (ICS), beyond their previous focus on digital defacement or DDoS. Experts emphasize that organizations managing critical infrastructure should enhance security measures—through stronger authentication, network segmentation, and real-time intrusion detection—to defend against evolving cyber threats exemplified by groups like TwoNet.
The report on this incident originates from cybersecurity firm Forescout, which observed and documented the hackers’ movements within the decoy system, illustrating their shift toward more dangerous operational targets. The findings highlight concerns about how hacktivist groups are transitioning from traditional online disruptions to more sophisticated and potentially damaging attacks on physical infrastructure, emphasizing the importance of robust cybersecurity protocols to mitigate such risks.
Critical Concerns
The cyber risks posed by groups like TwoNet highlight a substantial evolution in threat landscapes, moving from traditional DDoS attacks to sophisticated targeting of critical infrastructure via web application exploits. In a recent incident involving a deceptive water treatment facility, the group swiftly transitioned from initial access to disruptive operations within 26 hours, exploiting vulnerabilities such as default credentials and outdated security flaws like CVE-2021-26829. Despite operating unknowingly within a honeypot environment, their actions disrupted process controls, disabled logs, and manipulated HMI settings, demonstrating their intent and technical capability to compromise operational technology (OT) systems. Their shift from supportive cyber activism toward targeting industrial control systems (ICS) underscores the escalating danger of cyberattackers leveraging web application vulnerabilities to threaten public safety, infrastructure integrity, and national security. This evolving threat calls for rigorous security measures, including robust authentication, segmentation of industrial networks, IP-based access controls, and intrusion detection protocols specific to OT environments, to prevent exploitation and minimize potential catastrophic impacts.
Possible Remediation Steps
Timely remediation of cyber attacks targeting critical infrastructure, like hacktivists hitting a decoy plant, is essential to prevent widespread disruption, safeguard public safety, and ensure continuity of essential services. Rapid response minimizes damage, restores normal operations quickly, and bolsters defenses against future threats.
Mitigation Strategies
- Immediate isolation of affected systems to contain the breach.
- Comprehensive incident analysis to determine attack scope and methods.
- Deployment of advanced intrusion detection systems (IDS) and firewalls.
- Activation of emergency response protocols, including communication plans.
Remediation Actions
- Patching and updating software vulnerabilities exploited during the attack.
- Conducting forensic investigations to identify perpetrators and attack vectors.
- Enhancing security policies and access controls to prevent recurrence.
- Training staff on cybersecurity best practices and threat awareness.
- Collaborating with law enforcement and cybersecurity agencies for coordinated response.
Stay Ahead in Cybersecurity
Stay informed on the latest Threat Intelligence and Cyberattacks.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
