Anatomy of hacktivist attacks: Detecting and mitigating emerging threats

Hacktivism is increasingly intertwined with cybercriminal and state interests, from selling initial access and exploits to acting as a front for state-sponsored groups. This shift may be driven by several strategic factors, such as enhanced campaign visibility, a means to finance operations and plausible deniability for state-aligned perpetrators.

Understanding the current tactics, techniques and procedures (TTPs) of the most relevant hacktivist groups therefore provides insight into the modern threat landscape.

Since 2022, we have been reporting on hacktivist groups expanding their TTPs beyond traditional website defacements and distributed-denial-of-service (DDoS) attacks to more sophisticated methods, including data leaks and disruption of cyber-physical systems within critical infrastructure.

Critical infrastructure organisations – especially in Europe – remain disproportionally targeted by hacktivists. In September 2025, our honeypot simulating a water treatment OT/ICS network was breached by an emerging pro-Russian group called TwoNet. They logged into the HMI using default credentials, defaced it, tampered with PLC parameters, disabled logs, and deleted data. We often capture similar events in dedicated honeypots and follow online conversations that allow us to understand their TTPs, from targeting to initial access and post-exploitation.

In this talk, we will review some of the groups, alliances and attacks we have followed to distill lessons learned, including the need to eliminate default credentials, segment OT networks rigorously, and deploy deep-packet inspection for threat detection.

For asset owners, this underscores the growing sophistication of hacktivists and the critical importance of visibility, segmentation, and hardened controls to defend against real-world OT threats.