Z-Pentest Alliance — Pro-Russia-aligned Hacktivist Alliance (OT/ICS Intrusion & Disruption)

Classification: TLP: WHITE — Open Source Intelligence (OSINT)

Category: Cyber / Hybrid — Hacktivism with OT/ICS focus; intimidation and disruption

Assessed home base: Serbia-linked in self-presentation; operationally embedded in a broader pro-Russia-aligned ecosystem

Executive Summary

Z-Pentest Alliance is a pro-Russia-aligned hacktivist coalition brand frequently cited in OSINT as a high-tempo actor focused on critical infrastructure narratives and, notably, internet-exposed OT/ICS environments. Multiple OSINT sources describe a shift beyond traditional hacktivist DDoS and defacement toward unauthorized access to industrial control interfaces (HMI/SCADA) and the public release of videos to amplify psychological impact.

Government and international reporting on pro-Russia hacktivism highlights opportunistic exploitation of weak remote-access exposures (including VNC) to access OT devices and conduct disruptive operations. In this context, Z-Pentest is consistently positioned among the more prominent pro-Russia-aligned brands targeting critical infrastructure.

Confidence is high that the Z-Pentest Alliance brand is used within pro-Russia hacktivist ecosystems and is strongly associated with OT/ICS-themed intimidation and disruption narratives. Confidence is medium regarding the true operational impact of claimed OT “sabotage,” as several sources assess some claims as primarily psychological and not necessarily resulting in material operational disruption.