Pro-Russian TwoNet Hacktivists Target Water Utility Honeypot

A pro-Russian hacktivist group boasted on Telegram that it hacked a Western water treatment plant – but actually succeeded in attacking a honeypot left by security researchers at Forescout, the firm said.

See Also: AI vs. AI: Leveling the Defense Playing Field

Forescout said the recently-formed TwoNet group apparently thought it scored a coup by forcing “HACKED BY BARLATI, FUCK” to pop up on a human-machine interface login page of a water utility plant.

TwoNet appears to have ceased operations on Sept. 30. Two handles most associated with the group, “BARLATI” and “DarkWarios,” appear to have gone dark.

“This underscores the ephemeral nature of the ecosystem where channels and groups are short-lived, while operators typically persist by rebranding, shifting alliances, joining other groups, learning new techniques, or targeting other organizations,” Forescout wrote.

TwoNet’s intrusion began from an IP address registered to a German hosting provider that has little history of being used by hackers. The attacker gained initial entry into the HMI by using default credentials admin and admin. The attacker ran SQL queries to extract the database schema. He then created a new account for “BARLATI” and exploited known vulnerability CVE-2021-26829, to modify the login page.

Activity on TwoNet’s defunct Telegram channel shows an initial interest in DDoS attacks giving way to a broader mix of activity, including attempts at breaching HMI or SCADA interfaces of critical infrastructure in “enemy countries.” The group also offered to sell a putatively new crypto-locker, although Forescout researchers said the pitch looked like a scam.

TwoNet also advertised supposed access to “SCADA systems in Poland.” The operators behind the channel did a lot of what Forescout calls “signal-boosting” – essentially the frequent reposting of missives from other hacktivist groups.

The shift in TwoNet’s interests are indicative of a developing interest by hacktivist groups aligned with state interests in breaching critical infrastructure. Many attempts – as in TwoNet’s supposed water utility hack or a pro-Iranian group’s debunked claim earlier this year of breaching Indian nuclear secrets – fall laughably short (see: Hacktivists’ Claimed Breach of Nuclear Secrets Debunked).

But don’t dismiss hacktivists as hapless, Forescout said. Misread targets, exaggerations or honeypot traps “doesn’t make them harmless; it shows where they are headed.”