Hacktivist Attacks on Critical Infrastructure in North America: A Rising Threat

Executive Summary

Hacktivist groups have escalated their cyber operations against critical infrastructure in North America, focusing on sectors such as energy, water, and healthcare. These attacks leverage vulnerabilities in industrial control systems (ICS) and operational technology (OT), posing significant risks to public safety and national security.

Current Threat Landscape

In the third quarter of 2025, hacktivist attacks on ICS systems doubled compared to the previous quarter, accounting for 25% of all hacktivist activities by September. This trend indicates a strategic shift towards targeting critical infrastructure. (thecyberexpress.com)

Pro-Russian hacktivist groups, including the Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), and Sector16, have been particularly active. These groups exploit minimally secured, internet-facing Virtual Network Computing (VNC) connections to infiltrate OT control devices within critical infrastructure systems. (fbi.gov)

Notable Incidents

• Water and Wastewater Systems: In October 2025, Canadian cybersecurity officials reported attacks on internet-accessible ICS devices in water facilities, leading to degraded service. (thecyberexpress.com)

• Energy Sector: In early 2024, the U.S. Department of Energy disclosed that Volt Typhoon, a China-linked threat actor, maintained unauthorized access to the OT network of Littleton Electric Light & Water Departments for nearly a year, aiming to exfiltrate data related to OT operating procedures and the energy grid layout. (csis.org)

Implications

The increasing sophistication of hacktivist attacks on critical infrastructure underscores the need for enhanced cybersecurity measures. The exploitation of ICS and OT vulnerabilities can lead to significant disruptions, economic losses, and potential threats to public safety.

Recommendations

• Strengthen Cyber Hygiene: Organizations should implement robust security protocols, including regular updates and patching of ICS and OT systems, to mitigate vulnerabilities.

• Monitor and Respond: Continuous monitoring of network traffic and system behaviors can help detect and respond to unauthorized access attempts promptly.

• Collaborate and Share Information: Engaging with governmental agencies and industry groups facilitates the sharing of threat intelligence and best practices.

Conclusion

Hacktivist groups' increasing focus on critical infrastructure in North America presents a critical threat that requires immediate and sustained attention. By adopting comprehensive cybersecurity strategies and fostering collaboration, organizations can enhance their resilience against these evolving threats.

Highlights:

• Hacktivist Attacks on Critical Infrastructure Soar: Cyble Report – The Cyber Express, Published on Sunday, November 02
• Hacktivist ICS Attacks Hit Canadian Critical Infrastructure, Published on Wednesday, October 29
• Securing U.S. Critical Infrastructure against Evolving Cyber Threats | Strategic Technologies Blog | CSIS, Published on Sunday, March 08