Russian-aligned hacktivist groups are increasingly targeting industrial control systems and OT environments—and sometimes it’s shockingly easy. In this episode, Daniel dos Santos, VP of Research at Forescout, walks through how his team used a honeypot to observe an attack against a simulated water treatment facility. We explore attacker motivations, common entry points, and what defenders must prioritize now.

What You’ll Learn

• How honeypots can uncover real-world hacktivist tactics and behaviors
• Why exposed HMIs remain one of the weakest entry points in OT environments
• How Telegram has become a primary platform for hacktivist attack claims
• The evolving motivations behind Russian-aligned hacktivist groups
• Why visibility across all networked devices is critical to defense
• How opportunistic attacks differ from targeted nation-state operations
• Practical steps to avoid becoming “easy prey” for attackers

Episode Highlights

• How the Attack Was Discovered Spotting the honeypot activity through Telegram claims
• The Entry Point Explained Default credentials and exposed HMIs
• Hacktivist Motivation Shift From activism to geopolitics and profit
• Why OT Attacks Are Hard to Eradicate Hidden devices and lateral movement
• The Core Defensive Takeaway Don’t ignore opportunistic threats

Episode Resources

• Forescout Research Reports
• Telegram (hacktivist communications platform)
• Canadian Government OT Security Alert
• Shodan (internet-exposed asset scanning tool)