MalwarePublished 10 Oct 2025Updated 9 Nov 2025

Blog Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS

Source AlienVault OTX General

Description

Forescout honeypot caught hacktivist activity targeting a decoy water treatment plant in Sept.2025. A Russian-aligned group, TwoNet, claimed responsibility for the attack. The group logged into the human-machine interface (HMI) for: defacement, process disruption, manipulation, and evasion.

Impact

For European organizations, especially those managing critical infrastructure like water treatment plants, this threat poses significant risks. Unauthorized HMI access can lead to process disruptions, potentially causing water supply interruptions, contamination risks, or damage to physical equipment. Defacement and manipulation undermine trust in infrastructure integrity and can cause public safety concerns. The use of ransomware tools in OT environments could escalate the impact by encrypting critical control systems, leading to prolonged outages and costly recovery efforts. The presence of IP indicators from Germany and France suggests that attackers may already have footholds or are targeting entities within these countries. Disruption of water treatment services can have cascading effects on public health, industrial operations, and municipal services. Additionally, the attack highlights vulnerabilities in legacy protocols like Modbus, which are widely used in European OT systems. The medium severity rating indicates a tangible but not yet catastrophic threat, emphasizing the need for proactive defenses to prevent escalation.

Defensive guidance

European OT/ICS operators should implement multi-layered security controls tailored to industrial environments. Specific recommendations include: 1) Enforce strict access controls and network segmentation to isolate HMIs and critical OT components from corporate and internet-facing networks. 2) Deploy robust authentication mechanisms, including multi-factor authentication (MFA), for all HMI and remote access points to prevent credential abuse. 3) Monitor and restrict Modbus and other legacy protocol traffic using deep packet inspection and anomaly detection tools to identify unauthorized commands or manipulations. 4) Conduct regular vulnerability assessments and patch management focused on OT-specific software and hardware, even if no direct patches exist, to reduce attack surface. 5) Implement continuous network monitoring with OT-aware intrusion detection systems (IDS) to detect reconnaissance and lateral movement activities. 6) Use honeypots or deception technologies to detect early-stage intrusions and gather intelligence on attacker tactics. 7) Develop and regularly test incident response plans specifically for OT/ICS scenarios, including ransomware recovery procedures. 8) Collaborate with national cybersecurity centers and share threat intelligence related to TwoNet and similar groups. 9) Restrict and monitor remote access channels, employing VPNs with strong encryption and logging. 10) Train OT personnel on social engineering and credential security to reduce risk of credential compromise. These measures go beyond generic advice by focusing on OT-specific protocols, access controls, and detection tailored to the tactics observed in this threat.

Indicators of compromise

IP addresses 10

45.14.247.87CC=RU ASN=AS61390 garant-g ltd.
92.43.161.74CC=IR ASN=AS58224 iran telecommunication company pjs
95.90.199.75CC=DE ASN=AS3209 vodafone gmbh
2.181.103.232CC=IR ASN=AS58224 iran telecommunication company pjs
212.83.190.55CC=FR ASN=AS12876 online s.a.s.
45.157.234.199CC=DE ASN=AS58212 php-friends gmbh
5.106.148.199CC=IR ASN=AS197207 mobile communication company of iran plc
77.91.122.234CC=RU ASN=ASNone
80.210.133.38CC=IR ASN=AS58224 iran telecommunication company pjs
87.150.146.207CC=DE ASN=AS3320 deutsche telekom ag

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Oct 2025, 17:26 UTC

MITRE ATT&CK techniques7 from threat tags

Technical details

Indicators of compromise

IP addresses 10

Community reviews

Related threats