On May 6, 2025, CISA, the FBI, the Environmental Protection Agency, and the Department of Energy issued a joint alert warning that US oil and natural gas operators have active hacktivist intrusions inside their industrial control systems. The advisory identified no zero-days and named no specific threat actors. The technique it described was default credentials against internet-exposed SCADA.
The alert was narrowly written: “CISA is increasingly aware of unsophisticated cyber actor(s) targeting ICS/SCADA systems within US critical infrastructure sectors (Oil and Natural Gas), specifically in Energy and Transportation Systems.” The agencies declined to identify what triggered the disclosure. CISA said publicly that “poor cyber hygiene and exposed assets can escalate these threats, leading to significant consequences such as defacement, configuration changes, operational disruptions and, in severe cases, physical damage.”
The groups the advisory did not name
By the time the advisory was published, the primary threat actors were already well documented by the threat intelligence community. Three clusters account for the bulk of documented oil and gas ICS intrusions.
Sector 16 emerged publicly in January 2025 when it posted a video alongside Z-Pentest demonstrating access to a SCADA system managing oil pumps and storage tanks at an unnamed Texas facility. The footage showed live operational data: tank levels, pump and casing pressures, alarm management panels, shutdown management controls, valve interfaces, flow measurement data (including Lease Automatic Custody Transfer readings), and gas lift operations. Both groups embedded their logos in the recording. The following month, Sector 16 separately claimed access to GEA’s natural gas cooling systems in Germany. In January 2025, in partnership with the hacktivist group OverFlame, it targeted French hydroelectric plants operated by DYNELEC. The US State Department’s Rewards for Justice program has since posted a reward of up to $500,000 for information leading to the identification of Sector 16 members, citing violations of the Computer Fraud and Abuse Act.
Z-Pentest had preceded the Sector 16 partnership with its own oil field claims. In December 2024 it published screenshots purporting to show access to a US oil well control system, with tank setpoints and vapor recovery metrics visible. By April 2025, Z-Pentest had expanded beyond energy to claim access to the HMI for a dam valve in Bremanger, Norway, opening the minimum-flow valve to 100 percent capacity for approximately four hours. Attribution of that incident was later confirmed by Norway’s Police Security Service (PST).
CyberAv3ngers, operating as a persona for Iran’s Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC), had been targeting water utilities since 2023 and expanded to Rockwell Automation PLCs across US water, energy, and government facilities in early 2026 under the campaign documented in joint advisory AA26-097A.
The attack is simple because it does not need to be complicated
Every documented intrusion in this cluster follows the same pattern. Operators scan public IP ranges for internet-facing virtual network computing (VNC) endpoints and HMIs. They authenticate using default or easily guessed credentials. Once inside, they interact directly with the operational interface: modifying setpoints, disabling alarms, changing credentials to lock out operators, and recording screen captures for Telegram publication. There is no custom malware, no lateral movement through corporate networks, and no persistence infrastructure worth the name. The access is the exploit.
This is possible because a large share of operational technology in the oil and gas sector is connected directly to the internet, often as a legacy consequence of remote monitoring deployments made before cybersecurity requirements caught up. Oil and gas operators are not subject to mandatory ICS security standards equivalent to NERC CIP (which applies to electric utilities). The resulting security maturity is inconsistent across the sector.
December 2025: the agencies named the groups
On December 9, 2025, CISA and the FBI, joined by the NSA and international partners including Canada’s Centre for Cyber Security, published advisory AA25-343A formally naming the actors the May advisory had characterized only as “unsophisticated”: Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), and Sector 16. The advisory confirmed that these groups had caused confirmed operational consequences, including physical damage in some cases. Targeted sectors included Water and Wastewater Systems, Food and Agriculture, and Energy. The December advisory documented the same VNC-default-credential attack chain, adding that groups sometimes launched concurrent DDoS attacks against targeted networks to distract operators during SCADA manipulation.
Mitigations
Both advisories converge on the same short list of controls. OT devices should not be directly reachable from the public internet. Default credentials must be replaced with strong, unique passwords before deployment and rotated on any system that has been internet-exposed without them. Remote access should be restricted to private networks with phishing-resistant multi-factor authentication. IT and OT networks should be segmented using a demilitarized zone. Operators should maintain documented manual operation procedures and practice them, so that staff can sustain safe operations during a control-system outage. Coordination with original equipment manufacturers and managed service providers is recommended to identify misconfigured deployments that operators may not be aware of.
The practical ceiling on risk from these groups is set by whether the targeted system is internet-reachable with default authentication. Removing that condition removes the attack surface for the entire cluster.