Pro-Russian Hacktivist Targets OT/ICS Systems to Harvest Credentials

In September, a nascent pro-Russian hacktivist group known as TwoNet staged its first OT/ICS intrusion against a water treatment utility honeypot, exploiting default HMI credentials and using the HMI’s sql[.]shtm interface to run two rounds of SQL reconnaissance. According to the report, initial access was gained via admin/admin and the attack began at 08:22 AM UTC on a September day from IP 45.157.234[.]199, registered to AS58212 (dataforest GmbH).

Evidence suggests these SQL queries were entered manually, and the attacker’s user-agent string indicates a Linux-based Firefox workflow, though spoofing cannot be ruled out. Approximately seven hours after compromise, the adversary created a new HMI user account named BARLATI and performed several actions, including defacing the login page using CVE-2021-26829 and altering PLC data sources, setpoints, and logging settings, while not escalating privileges beyond the web application layer.

The incident underscores the need for high-fidelity deception technologies and vigilant monitoring of hacktivist channels to protect utilities’ OT/ICS environments.