Hacktivists deactivate after falling into researchers' trap

Security researchers say they duped pro-Russia cybercriminals into targeting a fake critical infrastructure organization, which the crew later claimed - via their Telegram group - to be a real-world attack. Forescout said the short-lived TwoNet hacktivist group fell for one of its researchers' honeypots, designed to look like a water treatment plant to a remote attacker. Although the intrusion turned out to be an embarrassing own goal for TwoNet, which went on to brag about its endeavours on the messaging and social media app, Forescout's warning is very real. The attack was benign in this case. However, in a real-world scenario, it would have been anything but. Within 26 hours, the attackers had broken into what they thought was a critical infrastructure organization and proceeded to tamper with key systems, defacing authentication screens and disabling alarms and logs. TwoNet initially gained access to the fake water treatment facility by abusing default credentials on the honeypot's human-machine interface (HMI) before enumerating the system's databases and establishing persistence. It then went on to exploit a vulnerability (CVE-2021-26829, CVSS 5.4), allowing it to deface the HMI login screen, and later carry out its disruptive processes, such as disabling real-time updates. TwoNet first popped up in January, primarily focused on DDoS attacks using the MegaMedusa Machine malware, Intel471 said. Its Telegram channel was shut down in March, and the group was not seen again...