# Pro-Russia Hacktivists (CARR/Z-Pentest/NoName057/Sector16) — GRU Unit 74455-Linked OT/ICS Attacks on US and Global Critical Infrastructure via VNC Exploitation

> Joint advisory AA25-343A from FBI, CISA, NSA, DOE, EPA, DC3, Europol EC3, and 20+ international partners warns of ongoing pro-Russia hacktivist groups — Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), and Sector16 — targeting OT/ICS systems in Water/Wastewater, Food/Agriculture, and Energy sectors. CARR was created and funded by GRU Unit 74455 (Sandworm/APT44). Groups exploit unsecured internet-facing VNC connections to access HMI devices, resulting in physical damage to critical infrastructure including US dairy farms and European wastewater facilities. Europol Operation Eastwood dismantled DDoSia infrastructure in parallel.

- **Published:** 2026-02-21T12:00:00Z
- **Last reviewed:** 2026-02-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0125
- **ID:** TL-2026-0125
- **Severity:** CRITICAL
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Actor:** Cyber Army of Russia Reborn (Russia)
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On February 20, 2026, the FBI, CISA, NSA, DOE, EPA, DC3, Europol EC3, and over 20 international partner agencies published joint advisory AA25-343A warning of ongoing pro-Russia hacktivist operations targeting critical infrastructure OT/ICS systems globally. This advisory accompanies CISA's May 2025 OT mitigation fact sheet and Europol's Operation Eastwood takedown of NoName057(16) DDoSia infrastructure.

## Threat Actor Groups

### Cyber Army of Russia Reborn (CARR)
CARR — also known as 'The People's Cyber Army of Russia' — was created in late February or early March 2022 with assessed direct support from GRU Unit 74455 (GTsST/Military Unit 74455), tracked by the cybersecurity community as Sandworm/APT44. GRU Unit 74455 likely funded CARR's DDoS tools through at least September 2024. CARR began operations via Telegram channel 'CyberArmyofRussia_Reborn' in April 2022, initially conducting DDoS attacks against US and European targets supporting Ukraine.

In late 2023, CARR expanded to ICS attacks, claiming an intrusion against a European wastewater treatment facility in October 2023. In November 2023, CARR targeted HMI devices at two US dairy farms. By late September 2024, CARR administrators became dissatisfied with GRU support levels, leading to the creation of Z-Pentest.

### Z-Pentest
Established September 2024, Z-Pentest is composed of members from both CARR and NoName057(16). The group specializes in OT intrusion operations targeting globally dispersed critical infrastructure. Unlike other pro-Russia groups, Z-Pentest largely avoids DDoS activities, focusing on OT intrusions to garner media attention. In March 2025, Z-Pentest posted OT device intrusion evidence using NoName057(16) campaign hashtags. In April 2025, Z-Pentest shared video of HMI defacement with CARR and NoName057(16) references.

### NoName057(16)
Created by CISM (Center for the Study and Network Monitoring of the Youth Environment) on behalf of the Kremlin. Senior CISM executives developed the DDoSia tool, paid for infrastructure, administered Telegram channels, and selected DDoS targets. Active since March 2022, NoName057(16) conducts frequent DDoS attacks against NATO member states. In July 2024, the group jointly claimed responsibility with CARR for alleged OT intrusions against US assets. Europol's Operation Eastwood (February 2026) targeted NoName057(16) infrastructure.

### Sector16
Formed January 2025 through collaboration with Z-Pentest. Novice pro-Russia hacktivist group maintaining Telegram presence with claims of compromising US energy infrastructure. Members may have received indirect Russian government support in exchange for specific cyber operations.

## Attack Methodology — VNC Exploitation Chain

The attack methodology is unsophisticated, inexpensive to execute, and easy to replicate:

1. **Reconnaissance**: Scan for internet-facing devices with open VNC ports (default 5900, range 5901-5910) using Nmap, OPENVAS, or similar internet-scraping tools.
2. **Initial Access**: Initiate temporary VPS for password brute-force operations. Use VNC software to access hosts with default, weak, or no passwords.
3. **Confirmation**: Confirm connection to vulnerable HMI device. Log IP address, port, and password.
4. **OT Manipulation**: Using HMI graphical interface, capture screen recordings while performing:
   - Modify usernames/passwords (operator lockout)
   - Modify operational parameters and setpoints
   - Modify device names (defacement)
   - Modify instrument settings
   - Disable/suppress alarms
   - Create loss of view (mandating local manual intervention)
   - Device restart or shutdown
5. **Propaganda**: Disconnect VNC, research compromised company, post embellished images/videos to Telegram channels promoting Russian ideology.
6. **Amplification**: Groups cross-post, amplify each other's claims, create additional channels, and share TTPs with new partner groups.

## Simultaneous DDoS + SCADA Pattern

Pro-Russia hacktivist groups have performed simultaneous DDoS attacks against targeted networks to facilitate SCADA intrusions, combining volumetric denial-of-service with direct OT manipulation.

## GRU/Sandworm (APT44) Context

GRU Unit 74455 (Sandworm/APT44) is responsible for some of the most consequential cyber attacks in history: Ukraine power grid disruptions (2015, 2016), NotPetya (2017), Olympic Destroyer (2018 Pyeongchang), and the 2022 Ukraine substation attack using MicroSCADA LotL techniques. Mandiant graduated Sandworm to APT44 in April 2024.

The GRU's disruptive playbook follows five phases: Living on the Edge (edge infrastructure compromise), Living off the Land (native tools), Going for the GPO (Active Directory wiper deployment), Disrupt and Deny (wipers/ransomware), and Telegraphing Success (hacktivist personas on Telegram). CARR and affiliated groups represent the 'Telegraphing Success' layer — GRU-sponsored personas conducting lower-sophistication operations with plausible deniability.

## Impact Assessment

While these groups demonstrate limited technical sophistication, their attacks have caused real physical impact:
- Temporary loss of view requiring manual intervention at water treatment and dairy facilities
- Unauthorized parameter modifications at energy sector HMI devices
- Operational downtime requiring PLC programmer intervention to restore systems
- Substantial labor costs for system remediation
- Attacks against occupied factories and community facilities demonstrate disregard for human safety

## Europol Operation Eastwood

On February 20, 2026, Europol EC3 announced Operation Eastwood, a global operation targeting NoName057(16) infrastructure. This coordinated takedown involved law enforcement agencies across multiple countries and dismantled DDoSia distribution infrastructure and command nodes.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1595.002 Vulnerability Scanning
- T1583.003 Virtual Private Server
- T1110.003 Password Spraying
- T1021.005 VNC
- T0883 Internet Accessible Device
- T0859 Valid Accounts
- T1694.001 Default Credentials
- T0886 Remote Services
- T0823 Graphical User Interface
- T0816 Device Restart/Shutdown
- T0878 Alarm Suppression
- T0892 Change Credential
- T0836 Modify Parameter
- T1692.001 Command Message
- T0828 Loss of Productivity and Revenue
- T0829 Loss of View
- T0831 Manipulation of Control
- T1498 Network Denial of Service
- T1113 Screen Capture
- T1036 Masquerading
- T1059 Command and Scripting Interpreter
- T1078.001 Default Accounts
- T1489 Service Stop
- T1133 External Remote Services
- T1018 Remote System Discovery
- T1491.002 External Defacement

## Sources

- [CISA/FBI/NSA Joint Advisory AA25-343A: Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a)
- [CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology](https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology)
- [Europol Operation Eastwood — Global Operation Targets NoName057(16) Pro-Russian Cybercrime Network](https://www.europol.europa.eu/media-press/newsroom/news/global-operation-targets-noname05716-pro-russian-cybercrime-network)
- [Mandiant/Google: APT44 (Sandworm) — Unearthing Russia's Notorious Cyber Sabotage Unit](https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm)
- [Mandiant/Google: Sandworm Disrupts Power in Ukraine Using Novel Attack Against Operational Technology](https://cloud.google.com/blog/topics/threat-intelligence/sandworm-disrupts-power-ukraine-operational-technology)
- [Mandiant/Google: The GRU's Disruptive Playbook — Five-Phase Operational Concept](https://cloud.google.com/blog/topics/threat-intelligence/gru-disruptive-playbook)
- [CISA: Russia Threat Overview and Advisories](https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia)
- [MITRE ATT&CK for ICS — Industrial Control Systems Framework](https://attack.mitre.org/versions/v18/matrices/ics/)
- [CISA: Identifying and Mitigating Living Off the Land Techniques](https://www.cisa.gov/sites/default/files/2025-03/Joint-Guidance-Identifying-and-Mitigating-LOTL508.pdf)
- [CISA: Cross-Sector Cybersecurity Performance Goals (CPGs)](https://www.cisa.gov/cross-sector-cybersecurity-performance-goals)
- [CISA: Stuff Off Search — Reduce Internet Attack Surface for OT](https://www.cisa.gov/resources-tools/resources/stuff-search)
- [CISA: Priority Considerations for OT Owners/Operators — Secure by Design Components](https://www.cisa.gov/sites/default/files/2025-01/joint-guide-secure-by-demand-priority-considerations-for-ot-owners-and-operators-508c_0.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0125