The U.S. Cybersecurity and Infrastructure Security Agency has added a long-standing OpenPLC ScadaBR vulnerability to its Known Exploited Vulnerabilities catalog, following confirmed evidence that attackers are abusing the flaw in live environments.
The weakness tracked as CVE-2021-26829 is a cross-site scripting issue affecting both Windows and Linux builds of ScadaBR through versions 1.12.4 (Windows) and 0.9.1 (Linux). While the bug isn’t new, its appearance in the KEV list signals something more serious: someone is actively using it against real targets.
A Hacktivist Group Mistook a Honeypot for a Water Facility
The update comes shortly after Forescout documented an attack on one of its industrial honeypots in September 2025. The attackers, identifying themselves as the pro-Russian group TwoNet, believed they were inside an actual water treatment plant.
They weren’t, but their actions still tell an important story.
Within roughly 26 hours, the intruders moved from initial access to disruptive changes. Using default credentials, they logged in, created a new user named “BARLATI”, and later exploited CVE-2021-26829 to deface the HMI login page with a pop-up message bragging: “Hacked by Barlati.”
They even disabled logs and alarms, unaware they were operating inside a controlled simulation.
According to Forescout, the attackers never attempted to escalate privileges or compromise the underlying host. Their focus stayed on the web layer, a reminder that even simple interface-level flaws can produce meaningful impacts on industrial systems.
TwoNet Expands From DDoS to Industrial Disruption
TwoNet first emerged on Telegram early this year with a focus on DDoS operations. Since then, they’ve branched into more aggressive territory:
1. Industrial system targeting
2. Doxxing
3. Ransomware-as-a-service
4. Hack-for-hire operations
5. Initial access brokerage
The group also claims ties to other hacktivist brands such as CyberTroops and OverFlame. Whether those claims are real or simply posturing, the intent is clear, they want visibility and impact, and industrial systems make for dramatic headlines.
Given the confirmed exploitation, U.S. Federal Civilian Executive Branch agencies have been ordered to patch affected systems by December 19, 2025.
OAST Infrastructure Used in Large-Scale Scanning Campaign
In a separate but relevant discovery, VulnCheck researchers uncovered a long-running exploit operation using Google Cloud to power an Out-of-Band Application Security Testing (OAST) setup. The activity appears heavily focused on Brazil, with:
1. 1,400+ exploit attempts
2. Across 200+ CVEs
3. From U.S.-based Google Cloud hosts
Interestingly, the scans resemble normal Nuclei-style probing, but the infrastructure choices and regional targeting stand out. The actor uses a network of subdomains under i-sh.detectors-testing[.]com, with callbacks dating back to late 2024, making this a year-long campaign, not a brief probe.
VulnCheck also identified a malicious Java class file, TouchFile.class, on a related IP address. This file expands on a public Fastjson exploit to execute attacker-supplied commands and send outbound requests. It’s a straightforward but effective way to chain reconnaissance and exploitation.
A Broader Trend: Commodity Tools, Real-World Impact
Both the TwoNet incident and the OAST scanning campaign show how attackers increasingly rely on:
1. Public cloud services
2. Open-source tools
3. Old but unpatched vulnerabilities
4. Automated scanning at massive scale
None of these techniques are new on their own, but in combination, they allow even mid-tier actors to cause significant disruptions.
CVE-2021-26829 isn’t the most severe vulnerability by score, but in environments where industrial interfaces control physical infrastructure, the stakes are far higher than the CVSS number suggests.
Source: The Hacker News
