Russian Hacktivists Increasingly Tamper with Energy and Water System Controls – Source:cyble.com

Overview 

Two Russian hacktivist groups are increasingly targeting critical infrastructure in the U.S. and elsewhere, and their attacks go well beyond the DDoS attacks and website defacements that hacktivist groups typically engage in. 

The groups – the People’s Cyber Army and Z-Pentest – have posted videos to their Telegram channels allegedly showing members tampering with operational technology controls (OT), most notably in the oil and gas and water system sectors. 

Those claims, documented by Cyble dark web researchers, may largely be intended to establish credibility rather than inflict damage on targets, but within the last week Z-Pentest’s claims have escalated to include disrupting one U.S. oil well system. 

The groups have also accessed operational controls for critical infrastructure in other countries, notably Canada, Australia, France, South Korea, Taiwan, Italy, Romania, Germany and Poland, often claiming retaliation for a country’s support for Ukraine in its war with Russia. 

Some of the attacks have been publicly reported – most notably the People’s Cyber Army attacks on water facilities – but Z-Pentest’s claims of energy sector attacks have largely flown under the radar. 

It is not clear how much damage the Russian groups could do or are capable of, but given repeated warnings from U.S. cybersecurity and intelligence agencies about China’s deep penetration of U.S. critical infrastructure, these environments should be considered deeply vulnerable and strengthened accordingly. 

Z-Pentest’s Activities 

Z-Pentest appears to have been active only since October, but in those two months Cyble’s dark web research team has recorded 10 claims of attacks by the group, all involving accessing control panels in critical infrastructure environments. Their main Telegram channel was recently shut down but the group maintains a presence on X and claims to be based in Serbia. 

Z-Pentest’s most recent claim involved disrupting critical systems at an oil well site, including systems responsible for water pumping, petroleum gas flaring, and oil collection. A 6-minute screen recording shows detailed screenshots of the facility’s control systems, showing tank setpoints, vapor recovery metrics, and operational dashboards, allegedly accessed and changed during the breach. It is not clear where that oil facility is located, but the other two U.S. oil facility claims appear to correspond with known locations and companies. 

In one of the other two claimed attacks, the threat group released a 4-minute screen recording where they accessed a range of operational controls (identifying information removed from example below). 

While the hackers may well be accessing sensitive environments, it is not clear how much damage they could do. Programmable logic controllers (PLCs), for example, often include safety features that can prevent damaging actions from occurring, but the fact that such environments are accessible to threat actors is nonetheless concerning. 

Cyble has in general observed increased threat activity targeting the energy sector in recent months. Dark web claims and ransomware attacks have increased, and network access and zero-day vulnerabilities have been offered for sale on dark web market places. Cyble has observed instances where credentials for energy network access were offered for sale on the dark web before larger breaches and attacks occurred, suggesting that monitoring for credential leaks may be an important defense for preventing larger breaches later. 

People’s Cyber Army Activities 

The better-known People’s Cyber Army (PCA) – also known as the Cyber Army of Russia Reborn – has also been targeting critical infrastructure controls in the U.S. and elsewhere, and there have been some suggestions that PCA and Z-Pentest may be working together. While many of the group’s activities have involved DDoS attacks, recent claims have included access to the control panels of a U.S. environmental cleanup company and water systems in Texas and Delaware. 

Water and wastewater systems are considered particularly vulnerable by some OT security specialists, in part because communities are ill-equipped to deal without them for any length of time. 

The People’s Cyber Army struck twice in late August and September, releasing screen recordings showing the group tampering with system settings on control panels at the Stanton Water Treatment Plant in Stanton, Texas, and New Castle, Delaware water towers (images below). 

Image above: Stanton Water Treatment Plant attack 

Image above: Delaware water tower attack 

In the Texas case, the hackers were able to open valves and release untreated water, but otherwise no damage is believed to have occurred. 

In all, Cyble has documented eight water system attacks by the People’s Cyber Army this year in the U.S. and elsewhere, including a January attack that caused water storage tanks to overflow in Abernathy and Muleshoe, Texas. The group has been targeting Ukraine allies since 2022, and was sanctioned by the U.S. government in July 2024. 

Conclusion 

Security weaknesses in critical infrastructure organizations are by now a well-documented phenomenon, but the recent spate of attacks targeting energy and water facilities suggests a concerning escalation in the exploitation of these vulnerable environments. The emergence of Z-Pentest as a new threat actor in this space should be taken seriously, as the group has demonstrated an apparent ability to penetrate these environments and access – and tinker with – operational control panels. 

Critical infrastructure environments often cannot afford downtime, and end-of-life devices often remain in service long after support has ended. With those challenges in mind, below are some general recommendations for improving the security of critical environments: 

1. Organizations should follow ICS/OT vulnerability announcements and apply patches as soon as they become available. Staying up to date with vendor updates and security advisories is critical to ensuring that vulnerabilities are addressed promptly. 

2. Segregating ICS/OT/SCADA networks from other parts of the IT infrastructure can help prevent lateral movement in case of a breach. Implementing a Zero-Trust Architecture is also advisable to limit the potential for exploitation. Devices that do not need to be exposed to the internet should not be, and those that require web exposure should be protected to the extent possible. 

3. Regular cybersecurity training for all personnel, particularly those with access to Operational Technology (OT) systems, can help prevent human error and reduce the risk of social engineering attacks. 

4. Ongoing vulnerability scanning and penetration testing can help identify and address weaknesses before attackers exploit them. Engaging threat intelligence services and staying updated with vulnerability intelligence reports is essential for proactive defense. 

5. Developing a robust incident response plan and conducting regular security drills ensures that organizations are prepared for a quick and coordinated response to any security incidents that may arise. 

Related