/
← Voltar ao feed
high water and wastewater food and agriculture energy critical infrastructure

Pro-Russia hacktivists (CARR, Z-Pentest, NoName057(16), Sector16) compromise internet-exposed VNC HMIs in critical infrastructure OT

1 fonte(s) · 1 atualização(ões) · publicado 05/12/2025 16:35 · coletado há 4 dias

A joint advisory (AA25-343A) from FBI, CISA, NSA and some 18 other US, European, Five Eyes and Czech agencies warns that pro-Russia hacktivist groups are conducting opportunistic, low-sophistication attacks on critical infrastructure OT. The groups named are Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16) and Sector16. They exploit minimally secured, internet-facing VNC connections to reach HMI and SCADA devices in the Water and Wastewater, Food and Agriculture, and Energy sectors. The authors assess that CARR was likely created with support from GRU unit 74455 (GTsST), and that NoName057(16) was created by the Kremlin-backed CISM. The activity has caused physical damage in some cases, though no injuries. The groups often exaggerate their claims, and the most common operational impact reported by victims is a temporary loss of view that requires manual operator intervention.

Detalhes técnicos

  • Actors scan for exposed VNC on port 5900 and nearby ports (5901-5910) using tools such as Nmap and OpenVAS.
  • They use temporary VPS instances to run password brute-force tools against default, weak or blank credentials, then log in to HMIs over VNC.
  • Once in, they change usernames, passwords, parameters, setpoints and device names, disable alarms, cause loss of view and restart or shut down devices. They record screen captures to post on Telegram.
  • In some cases they ran DDoS attacks at the same time to facilitate SCADA intrusions.
  • Timeline:
    • CARR moved into ICS targeting in late 2023, claiming a European wastewater facility intrusion and two US dairy farm intrusions.
    • Z-Pentest formed in September 2024 from CARR and NoName057(16) members.
    • Sector16 formed in January 2025 and claims US energy infrastructure intrusions.
    • The advisory describes TTPs observed as recently as April 2025.
  • NoName057(16) uses its proprietary DDoSia DDoS tool.

Remediação

  • Reduce public exposure of OT assets and use attack surface management to find exposed VNC, especially third-party-configured connections.
  • Segment IT and OT networks, use a DMZ, and enforce default-deny and egress filtering at OT perimeter firewalls.
  • Place remote access behind a firewall or VPN, and use time-limited access.
  • Enforce MFA, or strong unique passwords where MFA is not feasible, and change all default credentials.
  • Keep VNC and remote access software patched and maintain an asset inventory.
  • If exposed systems with weak or default passwords are found, assume compromise: isolate and reimage hosts, hunt for intrusion artifacts, rotate credentials and report to CISA, FBI or NSA.

Linha do tempo

  1. cisa.gov ↗ · pub. 05/12/2025 16:35 · coletado 19/10 18:37 primeiro registro

    Pro-Russia hacktivists (CARR, Z-Pentest, NoName057(16), Sector16) compromise internet-exposed VNC HMIs in critical infrastructure OT

    ler a análise desta fonte

    A joint advisory (AA25-343A) from FBI, CISA, NSA and some 18 other US, European, Five Eyes and Czech agencies warns that pro-Russia hacktivist groups are conducting opportunistic, low-sophistication attacks on critical infrastructure OT. The groups named are Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16) and Sector16. They exploit minimally secured, internet-facing VNC connections to reach HMI and SCADA devices in the Water and Wastewater, Food and Agriculture, and Energy sectors. The authors assess that CARR was likely created with support from GRU unit 74455 (GTsST), and that NoName057(16) was created by the Kremlin-backed CISM. The activity has caused physical damage in some cases, though no injuries. The groups often exaggerate their claims, and the most common operational impact reported by victims is a temporary loss of view that requires manual operator intervention.

    Technical Details

    • Actors scan for exposed VNC on port 5900 and nearby ports (5901-5910) using tools such as Nmap and OpenVAS.
    • They use temporary VPS instances to run password brute-force tools against default, weak or blank credentials, then log in to HMIs over VNC.
    • Once in, they change usernames, passwords, parameters, setpoints and device names, disable alarms, cause loss of view and restart or shut down devices. They record screen captures to post on Telegram.
    • In some cases they ran DDoS attacks at the same time to facilitate SCADA intrusions.
    • Timeline:
      • CARR moved into ICS targeting in late 2023, claiming a European wastewater facility intrusion and two US dairy farm intrusions.
      • Z-Pentest formed in September 2024 from CARR and NoName057(16) members.
      • Sector16 formed in January 2025 and claims US energy infrastructure intrusions.
      • The advisory describes TTPs observed as recently as April 2025.
    • NoName057(16) uses its proprietary DDoSia DDoS tool.

    Remediation

    • Reduce public exposure of OT assets and use attack surface management to find exposed VNC, especially third-party-configured connections.
    • Segment IT and OT networks, use a DMZ, and enforce default-deny and egress filtering at OT perimeter firewalls.
    • Place remote access behind a firewall or VPN, and use time-limited access.
    • Enforce MFA, or strong unique passwords where MFA is not feasible, and change all default credentials.
    • Keep VNC and remote access software patched and maintain an asset inventory.
    • If exposed systems with weak or default passwords are found, assume compromise: isolate and reimage hosts, hunt for intrusion artifacts, rotate credentials and report to CISA, FBI or NSA.