Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure

MITRE Techniques

• [T1591 ] Gather Victim Organization Information – Threat actors use internet-available information to identify systems they believe they compromised and post to social media. (‘Threat actors use information available on the internet to determine what systems they believe they have compromised and post the information on their social media.’)
• [T1595.002 ] Active Scanning: Vulnerability Scanning – Actors use open‑source tools to search for visible VNC services on common ports. (‘Threat actors use open source tools to look for IP addresses in target countries with visible VNC services on common ports.’)
• [T1583.003 ] Acquire Infrastructure: Virtual Private Server – Actors initiate temporary VPS instances to run password brute‑force software and obfuscate identifiers. (‘Initiate temporary virtual private server (VPS) to execute password brute force software.’)
• [T0883 ] Internet Accessible Device – Actors gain access through less secure HMI devices exposed to the internet, often via VNC. (‘Threat actors gain access through less secure HMI devices exposed to the internet.’)
• [T0859 ] Valid Accounts – Threat actors obtain access using legitimate accounts on HMI devices through credential guessing or default credentials. (‘Threat actors use password guessing tools to access legitimate accounts on the HMI devices.’)
• [T1110.003 ] Brute Force: Password Spraying – Actors employ tools to rapidly guess common or simple passwords against exposed services. (‘Threat actors use tools to rapidly guess common or simple passwords.’)
• [T0812 ] Default Credentials – Actors seek and leverage known default passwords for control devices to access accounts. (‘Threat actors seek and build libraries of known default passwords for control devices to access legitimate user accounts.’)
• [T0886 ] Remote Services – Actors leverage VNC and other remote services to access HMI devices over the internet. (‘Threat actors leverage VNC services to access system HMI devices.’)
• [T1021.005 ] Remote Services: VNC – Actors hunt for VNC‑enabled devices and connect using remote viewer software to interact with HMIs. (‘Threat actors hunt VNC-enabled devices visible on the internet and connect with remote viewer software.’)
• [T0823 ] Graphical User Interface – Actors interact with HMI GUIs to modify device settings, capture screenshots, and record actions. (‘Using the HMI graphical interface, capture screen recordings or intermittent screenshots while conducting the following actions…’)
• [T0892 ] Change Credential – Actors change usernames/passwords on HMI devices to lock out operators and create loss of view. (‘Modify usernames/passwords…’)
• [T0836 ] Modify Parameter – Actors attempt to change operational upper and lower limits and setpoints via the HMI. (‘Threat actors attempt to change upper and lower limits of operational devices as available from the HMI.’)
• [T0831 ] Manipulation of Control – Actors change instrument settings or setpoints to affect process efficiency or safety. (‘Threat actors change setpoints in processes, impacting the efficiency of operations for those specific processes.’)
• [T0878 ] Alarm Suppression – Actors use HMI interfaces to clear or disable alarms to conceal activity. (‘Threat actors use HMI interfaces to clear alarms caused by their activity and alarms already present on the system at the time of their intrusion.’)
• [T0829 ] Loss of View – Actors cause operator loss of remote view (often by changing credentials), forcing manual intervention. (‘Threat actors change credentials on HMI devices, preventing operators from modifying processes remotely.’)
• [T0816 ] Device Restart/Shutdown – Actors may cause device restarts or claim to power off HMIs, potentially leading operators to take systems offline. (‘Device restart or shutdown’)
• [T0855 ] Unauthorized Command Message – Actors attempt to send unauthorized commands to control system assets outside intended functionality. (‘Threat actors attempt to send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, causing possible impact.’)
• [T0828 ] Loss of Productivity and Revenue – Actors purposefully attempt to impact productivity and create additional costs for affected entities. (‘Threat actors purposefully attempt to impact productivity and create additional costs for the affected entities.’)