Threat Actor Characterization
TwoNet
ID: 035031254758b51f853749465e75b07196207Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
71baa6e296e685bb269cd958f3fd86a599046 | Anonymous Russia | Russia | affiliated | Hacktivist Group |
|
bc245f4663e20bad7d80595fc6306f8133384 | Bangladesh Cyber Troops | Bangladesh | affiliated | Hacktivist Group |
|
125c675b998f01a97afbfc3a83d41d1f83490 | DarkWarios | Russia | ally-of | Cybercrime |
|
b0f30e9e306cf2b21592b5d62555973402636 | Molot Team | Russia | affiliated | Hacktivist Group |
|
8e42712d8e2d0d7d6090bd2c3b4c94b794908 | PalachPro | Russia | related | Cybercrime |
|
4495af27123488e6a1133e5396e4efb857926 | SkullNet | Russia | affiliated | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
TwoNet — pro-Russia hacktivist crew (2025) using Telegram to coordinate DDoS and claim OT/ICS intrusions; high-profile 'water utility' hack was actually a Forescout honeypot revealing weak-credential access and basic HMI/PLC interactions.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 |
|
| T1585 | Establish Accounts | TA0042 |
|
| T1102 | Web Service | TA0011 |
|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1562 | Impair Defenses | TA0005 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
TwoNet is a recent entrant (2025) to the pro-Russia hacktivist space, coordinating via Telegram and focusing on DDoS and “hands-on” ICS/OT intrusion claims. In September–October 2025, TwoNet loudly claimed to have breached a Western water utility HMI, disabled alarms/logs, and tampered with PLCs—subsequent investigations by Forescout revealed the “plant” was a honeypot, exposing TwoNet’s TTPs and exaggerations. Despite the embarrassment, the episode shows growing intent by claim-driven actors to probe internet-facing OT. Confidence: high on the honeypot findings; medium on broader capability.
- Identity & posture. Russia-aligned; Telegram coordination; Intel471 and follow-on coverage place emergence in Jan–Jul 2025, recruiting for DDoS and collection.
- Objectives. Visibility through “critical infrastructure” narratives; OT/ICS signaling to amplify fear/attention; routine DDoS against Ukraine/ally targets.
