Pro-Russian Hacktivist Group TwoNet Compromises Water Treatment Facility Honeypot

Pro-Russian hacktivist group TwoNet recently targeted what they believed to be a real water treatment facility, which was in fact a sophisticated honeypot set up by cybersecurity researchers at Forescout. The group, previously known for distributed denial-of-service (DDoS) attacks, has shifted its focus to targeting operational technology (OT) in critical infrastructure, marking a significant escalation in their tactics. TwoNet gained initial access to the decoy plant by exploiting default credentials on the human-machine interface (HMI), specifically using 'admin/admin' to log in. Once inside, the attackers attempted to enumerate databases and succeeded after refining their SQL queries, demonstrating a methodical approach to reconnaissance. They created a new user account named 'Barlati' and exploited a known cross-site scripting (XSS) vulnerability, CVE-2021-26829, to display a defacement message on the HMI. Beyond defacement, TwoNet engaged in actions intended to disrupt plant operations, including disabling real-time process updates by removing programmable logic controllers (PLCs) from the data source list and altering PLC setpoints, which could have had dangerous consequences in a real facility. The attackers also attempted to disable logs and alarms, further indicating their intent to cause operational disruption and evade detection. Forescout researchers observed that the attackers did not attempt privilege escalation or exploitation of the underlying host, focusing their efforts on the web application layer. The entire attack sequence, from initial access to disruptive action, unfolded in approximately 26 hours, highlighting the group's efficiency and determination. TwoNet publicly claimed responsibility for the attack on their Telegram channel, falsely asserting it was a successful breach of real critical infrastructure. This incident is notable as it is the first time a hacktivist group has claimed an attack that researchers can confirm occurred on a honeypot. The event underscores the evolution of Russian hacktivism from DDoS attacks to more sophisticated OT intrusions with potential physical-world consequences. Security experts, including those from Deepwatch, have warned that such activities represent a growing asymmetric warfare capability, with hacktivist groups seeking to establish reputations as credible threats to critical infrastructure. The attack also involved attempts to manipulate the Modbus protocol, a common industrial control system protocol, further demonstrating the attackers' technical knowledge. While there is no direct evidence linking TwoNet's actions to Russian state direction, their tactics and public claims serve to amplify their perceived threat. The incident provides valuable insight into the methods and motivations of modern hacktivist groups targeting critical infrastructure. It also highlights the importance of honeypots in understanding adversary behavior and improving defensive measures for real-world OT environments. The rapid progression from access to disruption in this case serves as a warning to operators of critical infrastructure about the need for robust security controls and monitoring.