Hacktivism resurges – but don't be fooled, it's often state-backed goons in masks

Feature From triggering a water tank overflow in Texas to shutting down Russian state news services on Vladimir Putin's birthday, self-styled hacktivists have been making headlines. But don't let the Guy Fawkes avatars fool you. Today's "hacktivists," especially those going after critical infrastructure, often have less in common with just the digital vandals of the Nineties and Naughts than with government-backed cyber operators. Threat intel analysts say their tactics, targets, and timing suggest something calculated, and far more connected to nation-state interests. These are sophisticated groups that are now doing things that are destructive Earlier this year, operational technology cybersecurity firm Dragos revealed that in April 2024, pro-Ukraine hacktivist crew BlackJack compromised a Moscow municipal organization that maintains the city's communication system for a gas, water, and sewage network. After pwning routers and sensor gateways, the gang deployed OT-specific malware dubbed Fuxnet, which Dragos reckons is only the eighth-known industrial control system malware in existence. While there haven't yet been large-scale destructive attacks (in Western countries, at least) that can be traced back to hacktivists, many of today's groups have ties to government intelligence agencies and growing connections to offensive cyber units. It's all keeping network defenders on their toes and giving them a reason to keep tabs on these politically and socially minded crews. And t...