Cyber Centre, CSIS join warning on pro-Russia hacktivists hitting industrial controls
The Canadian Centre for Cyber Security and the Canadian Security Intelligence Service joined the FBI, CISA, the NSA and more than 20 international partners on Dec. 9 in warning that pro-Russia hacktivist groups are breaking into poorly secured industrial control systems around the world.
The attacks are unsophisticated, but they reach equipment that runs physical processes. The advisory says intrusions have caused loss of view at facilities, forced manual operations and, in some cases, physical damage, though no injuries have been reported.
Who is named
The joint advisory, AA25-343A, names four groups. It links the Cyber Army of Russia Reborn (CARR) to Russia's GRU military intelligence unit 74455 and describes NoName057(16), known for denial-of-service campaigns using its DDoSia tool, as a covert project of a Kremlin-established organization. Z-Pentest, formed in September 2024 by members of both groups, focuses on operational technology intrusions, hack-and-leak and defacement. Sector16, formed in January 2025, claims compromises of U.S. energy infrastructure.
How the attacks work
The groups scan the internet for virtual network computing (VNC) services left exposed, then use default or weak passwords to reach human-machine interfaces. Once in, they change setpoints, suppress alarms, change credentials or shut devices down. Victims named in the advisory include water and wastewater systems, dairy farms and oil well operations. The authors note the groups often exaggerate what they achieved, but even minor intrusions cost operators time and money.
Canada has seen similar activity. The Cyber Centre warned in a 2025 alert, AL25-016, about hacktivists abusing internet-accessible industrial control systems in Canadian critical infrastructure, and CSE's annual report describes a NoName claim in October 2025 of access to a Quebec municipal water treatment plant.
The Cyber Centre's summary urges Canadian operators to apply the advisory's recommendations.
What to do
- Remove operational technology from direct internet exposure and use attack surface tools to find exposed VNC services.
- Segment IT and OT networks with default-deny firewall rules.
- Change default passwords, require multi-factor authentication for remote access and make remote accounts view-only where possible.
- Keep backups of HMI configurations, rehearse manual operations and alert on setpoint changes outside safe ranges.
