Forescout’s Vedere Labs published research in late April 2026 documenting the September 2025 compromise of a decoy water-treatment HMI it operates as part of a long-running OT honeypot network. The intruder was TwoNet, a pro-Russia hacktivist persona that had appeared on Telegram in January 2025 with a DDoS focus and pivoted in September to claim ICS access. Within hours of breaching the honeypot, TwoNet posted screenshots to its Telegram channel framing the access as a successful hit on a real US water utility. The channel then went quiet and was abandoned within weeks. Forescout has declined to disclose the exact geography of the decoy.
The intrusion mechanics are deliberately ordinary. TwoNet authenticated to the HMI using default credentials that the honeypot was configured to accept, then ran reconnaissance using Metasploit modules, attempted setpoint changes through Modbus function codes, and probed S7Comm and S7Comm-Plus services on adjacent decoy PLCs. There was no zero-day, no novel tooling, and no operational depth beyond initial access. The attacker spent roughly 30 minutes in the environment.
The research is editorially valuable because it is one of the cleanest primary-source records of the inflate-and-disappear pattern that has driven a steady volume of unverified hacktivist water-utility claims since 2023. The pattern rhymes with the Cyber Army of Russia Reborn (CARR) Telegram persona that Mandiant later linked to GRU Sandworm during the 2024 Muleshoe, Texas tank-overflow incident, and with the early CyberAv3ngers Unitronics campaign documented in the 2023 Aliquippa, Pennsylvania compromise. The difference is that those incidents were real; the value of TwoNet is that the artefact, the screenshots, and the boast are now public, source-cited, and falsifiable, which is rare in the hacktivist-claim space.
For defenders the practical implication is the dating of every Telegram screenshot against the actual condition of the named utility. The Multi-State ISAC’s recommended discipline (request an authoritative status statement from the named utility before treating a hacktivist screenshot as an incident) is now backed by a documented case in which the screenshot was real, the access was real, and the victim was a Forescout-operated decoy.