Hacktivist Attacks On Critical Infrastructure Surge In Q3 2025

Cyble’s Q3 2025 hacktivism report documents a rise in sophisticated, ideologically and state-aligned hacktivist activity shifting from DDoS/defacements toward ICS/SCADA attacks, data breaches, unauthorized access, and emerging ransomware/RaaS operations; notable incidents include an alleged 22TB Aeroflot data exfiltration, tampering with a U.S. water utility HMI and a Taiwanese agricultural SCADA system, and claims of destructive server wipes. The report highlights primary targets (energy & utilities, government, telecoms), key groups (Z-Pentest, INTEID, NoName057(16) and others), cross-region impact (Europe, Ukraine, Asia, North America), and advises isolating critical assets, applying segmentation and Zero Trust controls, and improving vulnerability and monitoring practices.