Hacktivism Guide: DDoS, Defacement and OT Claims

Hacktivist groups cause real disruption with simple techniques, then claim far more damage than they did, and some of them are fronts for state intelligence services. Since 2022 the wars in Ukraine and the Middle East have revived hacktivism: pro-Russian crews flood government and bank websites with traffic, deface sites, and post screen recordings of tampered industrial control panels, while personas such as CyberAv3ngers have been tied by governments to state military units. This guide explains how these campaigns work, where they land, how to separate a claim from an incident, and which controls stop most of it. It is written for security operations, OT engineers, communications leads and anyone who has to answer the question "are we really hacked?" at short notice.

Key takeaways

Most hacktivist impact is low-sophistication but costly. The UK NCSC described denial of service attacks by Russian-aligned groups as typically low in sophistication yet able to disrupt entire systems at significant cost (January 2026).
Exposed HMIs with weak passwords are the OT entry point. The December 2025 joint advisory AA25-343A describes groups finding internet-facing VNC services and guessing default or weak passwords, not exploiting zero-days.
Claims are routinely exaggerated or false. Government advisories and Mandiant research both say hacktivists inflate impact, recycle old data and forge leaks, so verify before you confirm anything publicly.
Some personas are state operations. The US government linked CyberAv3ngers to Iran's IRGC and linked the Cyber Army of Russia Reborn to GRU unit 74455, which changes your threat model and reporting duties.
Law enforcement disruption is temporary. Operation Eastwood took down more than 100 servers used by NoName057(16) in July 2025, but the core operators are believed to be in Russia and the group resumed attacks.

How the attack works

Mandiant defines hacktivism as activity where actors claim or conduct attacks with a stated political or social intent, usually combining a persona, tailored messaging and some disruptive cyber activity. The messaging matters as much as the attack: a campaign succeeds if it is noticed. Targets are chosen for symbolic value and attacks are timed to political events such as summits, elections, votes on military aid or anniversaries.

Common techniques

Technique	What happens	ATT&CK mapping	Typical real impact
Crowdsourced DDoS	Volunteers run a client that floods target websites and APIs with requests; NoName057(16) runs its DDoSia project through Telegram channels	T1498 Network Denial of Service, T1498.001 Direct Network Flood, T1499.002 Service Exhaustion Flood	Public websites slow or offline for hours; back-end systems usually untouched
Website defacement	Content on a public site is replaced with slogans, often through a vulnerable CMS plugin or a stolen admin credential	T1491.002 External Defacement	Reputational damage; possible underlying compromise of the web server
OT and HMI tampering	Internet-exposed HMIs reached over VNC are logged into with default or guessed passwords; setpoints are changed and screens recorded	T1595.002, T1110.003 Password Spraying, T1021.005 VNC; ICS T0883 Internet Accessible Device, T0836 Modify Parameter, T0878 Alarm Suppression	Mostly temporary loss of view and manual operation; some physical damage reported
Hack and leak	Stolen or claimed data is published, sometimes altered, forged or taken from an older breach	Not a single technique; collection and exfiltration techniques vary	Regulatory notification questions, media pressure, fraud risk to individuals

The OT intrusion pattern

Advisory AA25-343A, co-sealed by the FBI, CISA, NSA and international partners, describes a consistent and unsophisticated chain. Actors scan the internet for VNC services, usually on TCP port 5900 or ports 5901 to 5910, from temporary virtual private servers (T1583.003). They brute force or spray passwords against human machine interfaces that have default, weak or no passwords. Once on the HMI they use its graphical interface to change parameters, clear alarms, change credentials to lock out operators and deface screens, recording the session to publish online.

The 2023 CyberAv3ngers campaign followed the same logic. Advisory AA23-335A reported that IRGC-affiliated actors compromised Unitronics Vision Series PLCs with integrated HMIs at multiple US water and wastewater facilities because the devices were internet exposed and used default passwords. The default password weakness is tracked as CVE-2023-6448 in the CISA Known Exploited Vulnerabilities catalogue, and the devices listen on TCP port 20256 by default. Compromised screens displayed a message declaring equipment made in Israel a legal target.

Where it shows up

Government and local authorities: the NCSC alert of 19 January 2026 singled out UK local government and critical national infrastructure as targets of continued DoS campaigns.
Transport, finance, energy and defence suppliers: reporting on Operation Eastwood lists NATO sites, government agencies, transport, banks, defence firms, media and energy suppliers among NoName057(16) targets, with around 230 organisations hit in 14 waves of attacks in Germany alone.
Small utilities, farms and manufacturers: AA25-343A describes claimed intrusions at a European wastewater facility and US dairy farms, and attacks on occupied factories and community facilities. These organisations often have an HMI on the internet installed by an integrator years ago.
Event-driven targets: Switzerland was attacked during the June 2024 Ukraine peace summit and the Netherlands during the NATO summit in June 2025.

Who is behind the personas

Persona	Assessed affiliation (per source)	Main activity
NoName057(16)	Pro-Russian, active since March 2022; AA25-343A describes it as a covert project of a Kremlin-established organisation	Crowdsourced DDoS against NATO and European states; co-claimed a July 2024 US OT intrusion
Cyber Army of Russia Reborn (CARR)	AA25-343A links it to GRU unit 74455, which likely supported its creation and funded its DDoS tools	DDoS, then claimed ICS intrusions from late 2023
Z-Pentest and Sector16	Formed in 2024 and 2025 from CARR and NoName057(16) members; possible indirect state support for Sector16	OT intrusions, hack and leak, defacement; claims against US energy infrastructure
CyberAv3ngers	IRGC-affiliated persona per AA23-335A	PLC and HMI defacement; many earlier claims against Israeli infrastructure proved false

For background on state groups and how personas relate to them, see the Threat Actor Groups Guide.

Impact

The gap between claimed and actual impact is the defining feature of hacktivism. AA25-343A states that the groups often portray minor incursions as major breaches, and that the most common impact reported by victims is a temporary loss of view requiring manual operation (ICS T0829 Loss of View). Some incidents still caused physical damage, PLC programmer labour costs, downtime and network remediation (T0828 Loss of Productivity and Revenue, T0831 Manipulation of Control). AA23-335A records that CyberAv3ngers had falsely claimed compromises of several Israeli critical infrastructure organisations, and that most claims by the linked Soldiers of Solomon persona were proven false.

Operational: portals offline; operators in manual control; engineering time to restore logic.
Safety: unpredictable process changes by actors who do not understand the process; no injuries reported in AA25-343A, but the advisory flags disregard for human safety.
Cover for something worse: Mandiant warns that hacktivist personas can mask nation-state or criminal operations, so a noisy DDoS can coincide with a quieter intrusion.

Verifying a claim

Mandiant recommends analysing messaging, claims and independent evidence before drawing conclusions about capability or effect. In practice, run a short, repeatable check when a claim names you:

Capture the claim (post, channel, screenshots, sample files) with timestamps before it is deleted.
Match screenshots to your assets: HMI screen names, tag names, site names, software versions and timezone in any recording.
Check whether the named system is internet exposed and whether its logs show logins, parameter changes or alarm clears in the claimed window.
For a leak, compare samples against known historical breaches and third-party data before assuming a new compromise; Mandiant notes leaks may be altered, forged or obtained elsewhere.
For DDoS, compare the claimed time with CDN, WAF and ISP telemetry. A claim with no traffic spike is propaganda.
Decide the public line only after steps 2 to 5, and avoid repeating the attacker's numbers.

Detection

Signal	Source	Why it matters
Inbound connections to TCP 5900 to 5910 or 20256 from the internet	Perimeter firewall, external attack surface scans	Exposed VNC and Unitronics services are the documented entry points
Repeated failed HMI or VNC logins, then success	HMI and VNC server logs, jump host logs	Password spraying against default or weak credentials
Setpoint or parameter changes outside work orders	Historian, OT monitoring, PLC change logs	AA25-343A recommends alerting on setpoint deviations and mode or program changes
Alarms cleared or credentials changed on HMIs	HMI audit logs	Matches documented actions on objective, including operator lockout
Sudden request rate rise from many residential and VPS addresses	CDN, WAF, load balancer and ISP alerts	Typical of crowdsourced DDoS clients
Unexpected page content changes or new admin users on public sites	File integrity monitoring, CMS audit logs	Early warning of defacement and underlying web compromise
Your brand, sector or country named in hacktivist channels	Threat intelligence feeds, sector ISACs	Gives hours or days of warning before event-timed waves

See the Threat Intelligence Guide for building a monitoring and triage process around these channels.

Metrics

Exposed OT services: count of internet-reachable HMI, VNC and PLC services found by external scans; target zero.
Default credential rate: share of OT devices still on vendor default or shared passwords.
Time to mitigate DDoS: minutes from attack start to traffic scrubbed or service restored, from exercise and incident records.
Claim verification time: time from a public claim to an evidence-based internal verdict.
Backup currency: percentage of HMIs and PLCs with a tested logic and configuration backup less than 90 days old.

Prevention and hardening

DDoS readiness

The NCSC's DoS guidance, repeated in its January 2026 alert, sets five actions:

Understand your service: map where resources could be exhausted and which parts are your responsibility versus a supplier's.
Upstream defences: confirm what your ISP mitigates, consider third-party DDoS protection and a CDN, and understand when a provider may cut access to protect itself. Consider more than one provider.
Build to scale: use cloud auto-scaling or spare capacity to absorb bursts.
Plan your response: design graceful degradation, keep administrative access working during an attack, and provide a scalable fallback for essential services.
Test and monitor: test against the types and volumes of attack you might face and monitor to detect attacks early.

Detailed controls are in the DDoS Protection Guide and the Web Application Firewall Guide.

OT exposure and access

AA25-343A and AA23-335A give the same core measures, which address almost every documented hacktivist OT case:

Remove internet exposure first. Find every internet-facing HMI, VNC and PLC service, including those installed by integrators and vendors, and take them off the internet. Use external attack surface scans to confirm. See the Attack Surface Management Guide.
Replace default and shared passwords. Change defaults, remove unused authentication features and, for Unitronics devices, upgrade to the VisiLogic version the vendor and AA23-335A name, which forces a password change.
Put remote access behind a controlled gateway. Use a VPN or firewall with MFA, time-limited vendor access and IP allowlists with alerting on violations. Give remote users view-only accounts where they do not need control.
Segment IT from OT with a DMZ, default-deny rules and strict egress filtering, and audit the rule set.
Back up HMI and PLC logic, configuration and firmware, test restores, and rehearse manual operation.
Assume compromise where exposure and weak passwords coexisted. The advisory advises isolating affected hosts, hunting, reimaging and reissuing credentials, then reporting to national authorities.

Roll out site by site with the process owner present, keeping the previous rule set and logic backup as rollback. More detail is in the OT Security Guide and, for incident handling with safety in mind, the OT Incident Response Guide.

Websites and communications

Harden public web estates: patch CMS cores and plugins, enforce MFA for admin accounts, remove unused admin users and keep a known-good copy for fast restore after defacement.
Prepare holding statements: agree who confirms or denies a claim, and say nothing until verification is complete.

Decision guidance by organisation size

Situation	Priority	Trade-off
Small utility or manufacturer with an integrator-managed HMI	Remove internet exposure and change passwords this week; ask the integrator how they connect	Remote support becomes less convenient; agree a supervised access method
Local authority or public body with citizen portals	Upstream DDoS protection and CDN, plus a static fallback page for critical information	Cost of always-on scrubbing versus on-demand activation delay
Large CNI operator	OT monitoring for parameter changes, multiple DDoS providers, intelligence on hacktivist channels, joint exercises with suppliers	Monitoring and intelligence need staff to triage alerts and claims

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Threat identification and hacktivist intelligence	ID.RA-03	RA-3 Risk Assessment
DDoS protection and boundary control	DE.CM-01	SC-5 Denial-of-service Protection, SC-7 Boundary Protection
Remote access and authentication to HMIs	PR.AA-05	AC-17 Remote Access, IA-2, IA-5 Authenticator Management
Monitoring for setpoint and login anomalies	DE.CM-01, DE.AE-02	SI-4 System Monitoring
Incident handling, claim verification and communications	RS.MA-01, RS.CO-02	IR-4 Incident Handling
Manual operation and restore	RC.RP-01	CP-2 Contingency Plan

Common failure patterns

Forgotten integrator access: an HMI put on the internet for remote support years ago, with the vendor default password, is exactly the target AA23-335A and AA25-343A describe.
Confirming the attacker's story: a spokesperson repeats a claimed number of records or systems before anyone checks logs, amplifying a claim that may be false.
DDoS protection that only covers the main website: APIs, DNS, VPN gateways and payment pages sit outside the CDN and go down instead.
Treating DDoS as the whole incident: nobody looks for a parallel intrusion, although Mandiant warns personas can mask state operations.
No tested logic backup: after a parameter change or lockout, engineers rebuild PLC and HMI configuration by hand.

Practitioner checklist

Scan your external address space for VNC (TCP 5900 to 5910), Unitronics (TCP 20256) and other OT services and remove every exposure.
Replace default and shared OT passwords and give remote users view-only accounts where possible.
Route all vendor and engineer remote access through an MFA-protected gateway with time-limited sessions.
Alert on HMI login failures, alarm clears, credential changes and setpoint changes outside work orders.
Confirm upstream DDoS protection covers websites, APIs, DNS and remote access, and keep provider escalation contacts current.
Write a claim verification runbook and a holding statement, and name who signs off public responses.
Monitor hacktivist channels and sector ISAC reporting for your organisation, sector and country.
Back up HMI and PLC logic, configuration and firmware, and rehearse manual operation at least yearly.

Hacktivism Guide: DDoS, Defacement, OT Claims and Response