Targeting Operational Technology: The Hacktivist's Path to Public Attention and Disruption
Summary: Dragos WorldView reports that hacktivist groups motivated by geopolitical conflict have escalated from website defacements and denial-of-service attacks to targeting operational technology, with CyberAv3ngers compromising a Unitronics PLC at the Municipal Water Authority of Aliquippa in Pennsylvania in November 2023 using SSH brute-forcing and default passwords. Dragos assesses with moderate confidence that CyberArmyofRussia_Reborn acts as a proxy for APT28 and Sandworm, and in April 2024 the pro-Ukraine group Blackjack claimed to have used Fuxnet malware to disrupt 87,000 sensors at Moscow's Moskollektor.
Why it matters: Attacks that once required specialized knowledge now turn on default passwords and known VNC vulnerabilities, and the media attention they generate creates a feedback loop that Dragos says encourages further OT targeting - so a single unsecured PLC at a water utility is now both an operational risk and a public statement.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026