Pro-Russian Hacktivist Targets OT/ICS Systems to Harvest Credentials
In September, the pro-Russian hacktivist group TwoNet conducted its first operational technology and industrial control systems (OT/ICS) intrusion against a water treatment utility honeypot. The attack utilized default credentials and SQL-based schema…
In September, the pro-Russian hacktivist group TwoNet conducted its first operational technology and industrial control systems (OT/ICS) intrusion against a water treatment utility honeypot. The attack utilized default credentials and SQL-based schema extraction to create backdoor accounts and deface the human-machine interface (HMI), signaling a shift from distributed denial-of-service (DDoS) attacks to targeted utility attacks.
The attack began at 08:22 AM UTC, originating from IP address 45.157.234[.]199 associated with AS58212 (dataforest GmbH). Initial access was achieved using default HMI credentials (admin/admin). Through the sql.shtm interface, two rounds of SQL reconnaissance were conducted. The first round failed to enumerate primary keys, while the second successfully extracted table and column metadata:
SELECT t.TABLENAME, c.COLUMNNAME, c.COLUMNNUMBER, c.COLUMNDATATYPE, c.COLUMNDEFAULT, c.AUTOINCREMENTVALUE, c.AUTOINCREMENTSTART, c.AUTOINCREMENTINC FROM sys.systables t JOIN sys.syscolumns c ON t.TABLEID = c.REFERENCEID WHERE t.tabletype = 'T' ORDER BY t.TABLENAME, c.COLUMNNUMBER; SELECT t.TABLENAME, con.CONSTRAINTNAME, con.TYPE FROM sys.systables t JOIN sys.sysconstraints con ON t.TABLEID = con.TABLEID ORDER BY t.TABLENAME; The SQL commands were manually entered, indicating familiarity with HMI web interfaces and SQL schema structures. The user-agent string used was “Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0”, suggesting a Linux-based Firefox workflow, though spoofing is possible.
Defacement, Disruption, and Credential Exfiltration
Approximately seven hours after the initial compromise, a new HMI user account named “BARLATI” was created, and four distinct actions were executed. Using CVE-2021-26829, the attacker altered the HMI login page description to:
<script>alert("HACKED BY BARLATI, FUCK")</script> This defacement triggered a pop-up alert on the login page. The attacker also deleted configured PLC data sources, halting real-time updates, adjusted PLC setpoints via the HMI, and modified system settings to disable logs and alarms. No attempts were made to escalate privileges or exploit underlying host components.
The attack began at 08:22 AM UTC, originating from IP address 45.157.234[.]199 associated with AS58212 (dataforest GmbH).
TwoNet emerged in January 2025, initially conducting DDoS campaigns using the MegaMedusa Machine malware. The shift to OT/ICS targeting coincided with the launch of a new Telegram channel on September 14, claiming responsibility for this water-utility intrusion and other attacks on solar-plant and biomass-boiler control panels across Europe.
TwoNet's activities reflect a broader trend among hacktivist groups using alliances to exchange tooling, intelligence, and access. Despite bold claims, honeypot deployments often reveal frequent false starts and misdirection.
The water-treatment honeypot provided concrete indicators of compromise (IoCs), distinguishing actual tactics, techniques, and procedures (TTPs) from hacktivist exaggeration. Utilities remain vulnerable due to lagging security budgets and exposure of OT/ICS devices online.
Honeypot intelligence is crucial as hacktivists move beyond DDoS to OT/ICS. Integrating deception feeds into security operations allows critical infrastructure entities to differentiate real threats, track evolving alliances, and mitigate risks to essential utilities.
Vigilance and deceptive counters will be vital in safeguarding industrial systems against future hacktivist disruptions.
Based on reporting by GBHackers.