Pro-Russian Hacktivist Groups Target Critical Infrastructure in US and Allied Nations
An international coalition of cybersecurity agencies has warned of ongoing cyberattacks targeting essential services, with pro-Russian hacktivist groups exploiting vulnerabilities in critical infrastructure.
U.S. officials and their international allies revealed on Tuesday that hacktivist groups aligned with the Russian government are actively attempting to breach critical infrastructure systems. These groups, including Cyber Army of Russia Reborn, Sector16, NoName057(16), and Z-Pentest, are employing relatively unsophisticated tactics, but their actions nonetheless pose a significant risk of causing real-world harm. The attacks have targeted organizations within the energy, food and agriculture, and water sectors, with reported instances of “varying degrees of impact, including physical damage.”
Limited Capabilities, Intent to Cause Harm
Despite their limited technical expertise, these groups have demonstrated a clear intent to disrupt essential services. According to the advisory released by 26 agencies representing the U.S. and over a dozen other countries, the actors frequently misunderstand the processes they attempt to disrupt. This lack of understanding often leads to “haphazard attacks” where the intended physical damage doesn’t align with the actual impact. However, authorities emphasize that these limitations haven’t deterred the groups from willfully causing harm to vulnerable infrastructure.
“These groups have demonstrated intent and capability to inflict tangible harm on vulnerable systems,” stated a representative from the Cybersecurity and Infrastructure Security Agency (CISA). The advisory urges manufacturers of operational technology (OT) devices to prioritize “secure-by-design principles” during development.
Indictment and Arrest in Ongoing Investigation
The Justice Department announced the indictment of Victoria Eduardovna Dubranova, a Ukrainian national, on Tuesday for her alleged involvement in attacks on critical infrastructure as part of two of the pro-Russian groups. Dubranova was arrested and extradited to the U.S. earlier this year and is scheduled to stand trial in early 2026.
The investigation, involving six U.S. agencies – CISA, the FBI, the NSA, the Department of Energy, the Environmental Protection Agency, and the Department of Defense Cyber Crime Center – was conducted in collaboration with agencies from Australia, Canada, the Czech Republic, Europol, France, Germany, Italy, Latvia, Lithuania, New Zealand, Romania, Spain, Sweden, and the U.K.
Tactics and Mitigation Strategies
The advisory details the typical methods employed by these attackers, including “password spraying,” remote access to Human Machine Interface (HMI) devices controlling industrial equipment, issuing commands through HMIs, and altering passwords to lock out authorized personnel.
To counter these threats, officials recommend several mitigation steps. These include reducing the accessibility of OT systems to the public internet, implementing strong authentication protocols, actively monitoring network activity, and regularly practicing incident response and disaster recovery procedures.
“The single most important thing people can do to protect themselves is to reduce the number of OT devices or operational technology exposed to the public-facing internet,” explained a CISA official during a Wednesday briefing. “The cumulative impact of this malicious cyber activity poses a persistent and disruptive threat to essential services.”
Russian Military Ties and Notoriety Seeking
The joint advisory highlights the connections between these hacktivist groups and the Russian military. Cyber Army of Russia Reborn (CARR), in particular, is believed to have been established with assistance from Russian military intelligence. The Kremlin allegedly financed CARR’s access to cybercriminal services, including DDoS-for-hire platforms.
These groups often collaborate, amplifying each other’s claims of attacks on social media. While their primary motivation appears to be notoriety, they frequently exaggerate their successes and misrepresent their level of access to targeted networks. Authorities dismantled computer infrastructure belonging to NoName057(16) last July, issuing arrest warrants for seven members.
International Cooperation and Deterrence
Officials declined to comment on whether the arrest of Dubranova involved any cooperation with the Russian government, noting Moscow’s consistent refusal to assist in the apprehension of its nationals accused of cybercrime. However, the U.S. continues to share law enforcement and national security information with Russia when it could potentially mitigate threats to the homeland.
A senior FBI official emphasized the increasing number of cybercriminal arrests made by both traditional U.S. allies and countries not typically involved in such operations. “That increased operational tempo should serve as a deterrent to anybody who might engage in these kinds of attacks,” the official stated.
Dubranova’s charges include a first-ever charge of conspiracy to tamper with a public water system, underscoring the escalating seriousness of these attacks and the commitment of law enforcement to hold perpetrators accountable.
