Hacktivists Escalate Critical Infrastructure Attacks In 2025

Cyble’s 2025 Threat Landscape reports a significant escalation in hacktivism: actors shifted from DDoS/defacements to targeted ICS/OT intrusions, ransomware and wiper operations, and large-scale data exfiltration (including an alleged 20TB Aeroflot breach), often aligned with or supported by nation-state interests; critical sectors (government, energy, transport, manufacturing) across Europe, Asia, and the Middle East were heavily impacted and attackers increasingly used custom tooling, RaaS, and automated PoCs to weaponize exposed HMI/SCADA and VNC interfaces.