Forescout honeypot caught hacktivist activity targeting a decoy water treatment plant in Sept.2025. A Russian-aligned group, TwoNet, claimed responsibility for the attack. The group logged into the human-machine interface (HMI) for: defacement, process disruption, manipulation, and evasion.
In July-August 2025, India faced a surge of cross-border cyberattacks combining data breaches, DDoS, defacement, phishing, and malware. Pakistani, Bangladeshi, Russian, Indonesian, and likely Chinese actors targeted Indian judicial, defense, and transport systems. High-impact incidents included judicial server breaches, government website disruptions, retaliatory defacements, phishing schemes, and malware campaigns. Indian groups retaliated under 'Operation Vasudev Strike'. The attacks demonstrated the growing scale, sophistication, and multinational nature of hacktivist operations targeting India's digital infrastructure, blending hacktivism and cybercrime to challenge national security and public trust.
In May 2025, Pakistan-linked hacktivist groups claimed over 100 cyberattacks on Indian government, education, and critical infrastructure websites. However, an investigation reveals most breaches were exaggerated or fake. Alleged data leaks contained primarily public information, website defacements left no real impact, and DDoS attacks caused minimal disruption. The more significant threat came from APT36, which used Crimson RAT malware to target Indian defense networks following the Pahalgam terror attack. The malware, delivered through phishing emails with malicious attachments, allows remote execution of commands and data exfiltration. While hacktivist claims generated alarming headlines, the actual impact was limited, with most targeted websites operating normally.
