Blog Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS

Oct. 10, 2025, 5:05 p.m.

Description

Forescout honeypot caught hacktivist activity targeting a decoy water treatment plant in Sept. 2025. A Russian-aligned group, TwoNet, claimed responsibility for the attack. The group logged into the human-machine interface (HMI) for: defacement, process disruption, manipulation, and evasion.

Date

  • Created: Oct. 10, 2025, 4:56 p.m.
  • Published: Oct. 10, 2025, 4:56 p.m.
  • Modified: Oct. 10, 2025, 5:05 p.m.

Indicators

  • 87.150.146.207
  • 80.210.133.38
  • 77.91.122.234
  • 5.106.148.199
  • 45.157.234.199
  • 2.181.103.232
  • 95.90.199.75
  • 45.14.247.87
  • 92.43.161.74
  • 212.83.190.55

Attack Patterns

  • megaMedusa
  • TwoNet

Additional Informations

  • Energy