Pro-Russia Hackers Target US Critical Infrastructure in New Wave

CISA, FBI, and NSA warn that pro‑Russia hacktivist collectives (e.g., CARR, NoName057(16), Z‑Pentest, Sector16) are exploiting exposed VNC and other internet‑facing OT interfaces using simple reconnaissance, port scanning, and password‑guessing to access HMIs and disrupt water, food production, and energy systems; while relatively unsophisticated, these intrusions have caused temporary loss of view, altered parameters, and costly manual recovery. The advisory urges reducing public internet exposure, enforcing strong authentication and MFA, segmenting networks, maintaining up‑to‑date software, and having contingency plans for rapid manual operation.