Hacktivism and Critical Infrastructure: A New Threat

Introduction

When the group Vulcan—presumed to be a pro-Russian hacktivist network—attacked Berlin’s power grid, no ransom was demanded and no data was stolen. The goal was simpler: to paralyze operations and send a high-profile message (Reuters). This is the defining characteristic of hacktivism. Hacktivists are driven by ideology and politics; their primary goal is visibility and sowing uncertainty in society.

Who Are These Hacktivists—and How Do They Differ?

Most organizations have tailored their cyber defenses to a familiar threat model: a profit-driven attacker who operates quietly, wants to remain undetected, and wants something your organization possesses—data, credentials, intellectual property. Hacktivists break this mold. Visibility is the goal, not risk. While conventional cybercriminals go to great lengths to remain undetected, hacktivists do the exact opposite. They publicly claim responsibility for their attacks, post evidence on social media, and time their campaigns to coincide with political events for maximum impact. There are no stealthy attacks that the public never hears about.

When one thinks of hacktivist groups, Anonymous comes to mind first. However, many of today’s hacktivist groups have moved far beyond the loosely organized collectives of the early internet era. Generally, their motivations can be divided into four types:

1. ideological groups that target organizations that challenge their worldview
2. political groups that pursue specific agendas or oppose governments
3. nationalist groups that act in the interest of a country or an ethnic identity
4. opportunistic groups that join a cause when an opportunity arises.

In practice, these categories increasingly overlap—and that is precisely what makes the current situation so difficult to navigate. The most dangerous actors today are found at the intersection of nationalist and political motivations: state-affiliated groups—organizations that may appear independent but operate with tacit or direct state support and pursue geopolitical goals under an ideological guise. In the context of the war in Ukraine, pro-Russian groups have become the dominant force targeting European critical infrastructure—blending genuine ideology and state interests in a way that is deliberately difficult to disentangle (CISA).

These groups are increasingly collaborating across categories and forming far-reaching alliances. Ideological collectives, nationalist crews, and state-affiliated actors pool resources, share attack tools, and coordinate campaigns via Telegram channels and dark web forums. As collaboration grows, so does their level of capability—and with it, the scope of what they are capable of.

Overview Table: Relevant Hacktivism Groups

When one thinks of hacktivist groups, Anonymous comes to mind first. However, many of today’s hacktivist groups have moved far beyond the loosely organized collectives of the early internet era.

The Attack Landscape: Shift Toward Industrial Systems

DDoS (Distributed Denial of Service) attacks have long been the hallmark tool of hacktivism. In a DDoS attack, thousands of compromised devices—often computers and servers that have been incorporated into a botnet without their owners’ knowledge—are directed to simultaneously flood a target with requests, thereby exceeding its capacity limits. The result: legitimate users are locked out, websites go offline, login portals become inaccessible, and operational dashboards stop responding.

Inexpensive to carry out and executable with limited technical knowledge, DDoS remains the most frequently recorded method—accounting for 77% of incident types among 4,875 publicly reported EU incidents between July 2024 and June 2025, with hacktivists responsible for the overwhelming majority (ENISA Threat Landscape 2025). However, high volumes should not be equated with high impact. Only 2% of these hacktivist DDoS incidents caused measurable service disruptions (ENISA). A flooded portal is merely an inconvenience—it recovers within hours, and the damage is largely reputational.

The more consequential shift is taking place at a deeper level. As hacktivist groups become increasingly capable through cross-group collaboration, shared tools, and close ties to state-sponsored actors, they are shifting from DDoS to far more significant targets: Industrial Control Systems (ICS)—the technology that physically controls power grids, pipelines, water treatment plants, and transportation networks. ICS attacks require deep knowledge of operational technology environments, patient reconnaissance, and a level of coordination previously attributed almost exclusively to state-sponsored actors.

A successful attack does more than just take a website offline—it can damage equipment, trigger safety failures, and cause cascading outages with real-world consequences that no reboot can undo.

The figures clearly reflect this shift. ICS and OT breaches accounted for 29% and 31% of all recorded hacktivism activities in Q1 and Q2 2025 (Cyble). Over the course of the year, Europe saw the highest concentration of ICS-related breaches worldwide. Groups such as Dark Engine and Sector 16 have driven much of this escalation—Dark Engine carried out 26 ICS-targeted incidents in Q2 2025 alone, while Sector 16 conducted 14 confirmed attacks during the same period, both primarily targeting energy and utility infrastructure (Cyble). CyberArmy of Russia_Reborn has gone even further—by directly manipulating human-machine interfaces at water utilities in the U.S. and Poland, demonstrating that physical process disruptions are no longer a theoretical risk (U.S. Treasury).

Four actors demonstrate exactly what this means; their documented attacks show that these threats are no longer merely theoretical—ranging from massive DDoS waves to targeted interventions in industrial control systems to destructive wiper operations against major Western corporations.

NoName057(16): DDoS Attacks on the Financial Sector and Critical Infrastructure

Since spring 2022, NoName057(16) has been the most active pro-Russian hacktivism group in Europe. Its tool, DDoSia, combines its own botnet (hundreds of servers) with a crowdsourcing model in which volunteers are compensated in cryptocurrency for their participation. At the time of its dismantling, the group coordinated over 4,000 active volunteer clients. German authorities recorded 14 separate waves of attacks against more than 250 institutions (Europol, Juli 2025).

CARR (Cyber Army of Russia Reborn): OT Attacks on Critical Infrastructure

CARR is one of the few hacktivist groups that has demonstrably caused physical damage to critical infrastructure. The U.S. Department of Justice classifies CARR as “founded, funded, and directed by the GRU” (Unit 74455 / Sandworm). In December 2025, the joint advisory CISA AA25-343A—co-signed by 23 international agencies, including those from Germany, France, Italy, and Spain—identified CARR as one of the four main groups targeting critical infrastructure worldwide.

Handala Hack Team: Iran’s Cyber Front Against Israel and the West

Handala Hack Team is one of the most destructive hacktivism groups of our time. Check Point Research (2026) classifies Handala as an online persona of the Iranian threat actor Void Manticore (Red Sandstorm, Banished Kitten), which is attributed to the Iranian MOIS. Other personas: Karma (inactive) and Homeland Justice (Albania). Since 2025, the group has relied on NetBird for traffic tunneling as well as AI-assisted PowerShell wiper scripts.

Iran’s Coordinated Cyber Ecosystem: PLC Attacks on U.S. Infrastructure

On April 7, 2026, the FBI, CISA, NSA, EPA, DOE, and U.S. Cyber Command issued a joint advisory (CISA AA26-097A) warning of ongoing attacks by an Iran-affiliated APT group targeting internet-exposed Programmable Logic Controllers (PLCs) in U.S. critical infrastructure. The activity resembles previous operations by the CyberAv3ngers (Shahid Kaveh Group), which are attributed to the IRGC Cyber Electronic Command (CEC).

Implications for Organizations

Attack Readiness Is Unpredictable—But Opportunities Are Not

Hacktivists often time their attacks to coincide with external trigger events. Organizations familiar with relevant geopolitical events can anticipate the threat level and increase their defensive readiness accordingly.

The Escalation Threshold Has Dropped

The capability gap between DDoS-focused and ICS/OT-capable actors is narrowing. Moreover, DDoS resilience alone does not protect against the Handala model: Wiper + Hack-and-Leak + Psychological Operation.

Reputational Damage Is Part of the Attack Strategy

Incident response and crisis plans must include a prepared communication strategy for the public sphere—not just after the incident.

Selected Sources

• ENISA Threat Landscape 2025: https://www.enisa.europa.eu/
• Europol: Operation Eastwood (Jul 2025): https://www.europol.europa.eu/
• CyberScoop: NoName Disruption (Jul 2025): https://cyberscoop.com/
• Link11: NoName attacks German cities (Aug 2025): https://www.link11.com/
• Check Point Research: Handala Modus Operandi (2026): https://research.checkpoint.com/
• Security Affairs: Handala vs PSK WIND Technologies (Apr 2026)
• Wikipedia: Handala Hack Team: https://en.wikipedia.org/wiki/Handala_Hack_Team
• Cyble: Hacktivist Attacks on Critical Infrastructure (2025): https://cyble.com/
• CISA AA25-343A & AA26-097A: https://www.cisa.gov/
• Wired: Cyber Army of Russia Reborn: https://www.wired.com/
• Handala Hack Team Leak Page (OSINT, Apr 2026): https://handala-hack.tw/
• DomainTools DTI: Iranian Influence Ecosystem (2026): https://www.domaintools.com/