FBI/CISA Warn: Pro-Russia Hacktivists Target Critical Infrastructure Via Unsecured VNC HMIs

A coalition led by the FBI, CISA and the NSA has warned of opportunistic, pro-Russia hacktivists targeting critical infrastructure by exploiting unsecured VNC HMIs, according to Cybersecurity Advisory released on December 9, 2025. The groups are described as technically unsophisticated and prone to brute-force attacks that aim to cause physical damage to water systems, energy grids and food production facilities, across multiple regions.

The advisory notes that these actors rely less on zero-days and more on poor authentication and internet-facing VNC configurations, enabling access to OT control devices once inside. After gaining access, they are reported to modify device names, alter physical parameters, disable alarms and create “loss of view” conditions that obscure operators on the factory floor.

The advisory also identifies links to groups such as Cyber Army of Russia Reborn, NoName057(16), Z-Pentest and Sector16, and urges OT owners to reduce exposure to the public internet and implement robust authentication procedures alongside offline backups to recover manual control if systems are compromised.