Pro-Russia hacktivists conduct opportunistic attacks against US and global critical infrastructure

The authoring organisations assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems. Pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated groups—are capitalising on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include Water and Wastewater Systems, Food and Agriculture, and Energy.44444

The authoring organisations encourage critical infrastructure organisations to implement the recommendations in the Mitigations section of this advisory External Link to reduce the likelihood and impact of pro-Russia hacktivist-related incidents. For additional information on Russian state-sponsored malicious cyber activity, see CISA’s Russia Threat Overview and Advisories External Link webpage.

If your organisation or role involves sensitive data, policy, or research (particularly in areas of geopolitical interest), you may be a target for spear-phishing. Review recent communications for suspicious or unexpected sender behaviour.

• Reduce exposure of OT assets to the public-facing internet.
• Adopt mature asset management processes, including mapping data flows and access points.
• Ensure that OT assets are using robust authentication procedures.

The authoring organisations recommend organisations implement the mitigations detailed in the advisory  External Link to help improve cybersecurity posture. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage External Link for more information on the CPGs, including additional recommended baseline protections.