Feds: Pro-Russia Hactivists Target US Critical Infrastructure

Feds: Pro-Russia Hacktivists Target US Critical Infrastructure, a December 2025 advisory notes that unsophisticated hacktivists are probing US OT networks by compromising Internet-facing VNC connections and targeting water and wastewater, food and agriculture, and energy sectors.

The advisory identifies four groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), and Sector16—and says they have attacked minimally secured OT devices, leveraging temporary VPS and password brute-forcing to access HMI devices. It also states that CARR previously claimed attacks on US and European infrastructure, with Mandiant revealing a 2024 disclosure of such activity, and notes some associations with the GRU.

According to the advisory, the groups differ in methods, with Z-Pentest avoiding DDoS and pursuing hack-and-leak and defacement tactics. The article quotes John Hultquist of Google Threat Intelligence Group, who says the GRU is leaning toward using willing accomplices to obscure its hand, and mentions indictments in the Central District of California related to Victoria Eduardovna Dubranova.

Mitigations urged by CISA include reducing OT exposure to the Internet, improving asset management, and enabling control-system security features and disaster-recovery plans.