Hacktivist group
TwoNet
Origin: Russia Status: Active
Confidence: Confirmed
TwoNet is a recent entrant (2025) to the pro-Russia hacktivist space, coordinating via Telegram and focusing on DDoS and “hands-on” ICS/OT intrusion claims. In September–October 2025, TwoNet loudly claimed to have breached a Western water utility HMI, disabled alarms/logs, and tampered with PLCs—subsequent investigations by Forescout revealed the “plant” was a honeypot, exposing TwoNet’s TTPs and exaggerations. Despite the embarrassment, the episode shows growing intent by claim-driven actors to probe internet-facing OT. Confidence: high on the honeypot findings; medium on broader capability.
ATT&CK
MITRE ATT&CK
T1078.001Default Accounts
T1102Web Service
T1190Exploit Public-Facing Application
T1491.002External Defacement
T1498Network Denial of Service
T1562Impair Defenses
T1562.001Disable or Modify Tools
T1565.001Stored Data Manipulation
T1585Establish Accounts
Research
Selected OSINT
TwoNet, IT Army of Russia among new pro-Russian hacktivist groups targeting Ukraine|The RecordPro-Russian hacktivism: shifting alliances, new groups and risks|Intel 471Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS|Forescout Vedere LabsThreat Intelligence Advisory — TwoNet OT/ICS activity|Tata CommunicationsForescout's TwoNet water honeypot research revisited|RISI