BlastWaveBlastWaveHACKOPEDIA
Hackopedia • File 027
Simulated plant (Forescout)

TwoNet Water Plant Honeypot Intrusion (2025)

Volume 2Water edition2025Last verified 12 sources, 4 primaryHoneypot, not a real utility

In September 2025 a hacktivist group told Telegram it had hit a water plant. The plant was a research decoy, and its log shows what really happened: a default password, a defaced login, changed setpoints, alarms switched off.

Many hacktivist claims arrive as the only witness: a screen recording, a caption, a boast. TwoNet is the rare case where the other side kept a record. The water treatment plant the group claimed was a honeypot run by Forescout’s researchers, and the log is complete: in at 8:22 with the default password, a new account, and a last login the following morning. No real facility was touched.

The attacker is the unreliable narrator here, but be exact about what was unreliable. The group lied about the target. It did not obviously lie about the method. The log shows setpoints changed and the logs and alarms switched off from the same web screen it logged into. That switch, not the defacement, is the dangerous action: a plant whose record can be erased from its own screen cannot answer a claim like this one. That reading is BlastWave’s analysis.

What is not known: Forescout has not published the text of TwoNet’s Telegram claim. That it named a Dutch water facility comes from reporting, not from the post, which we did not see. The day of the intrusion and the time zone of the timestamps are not given. Who was behind the BARLATI account is undisclosed, and no government document names TwoNet. How closely the decoy resembled a working plant is Forescout’s to describe, and it has not published the design.

Recommendation

  1. Take the path away No operator screen should answer the internet. Remote access, where it is needed, goes through a brokered path that does not expose the screen at all.
  2. Remove credential-based standing access No default passwords, and no web session that can create accounts, change setpoints or reconfigure on a password alone. Each action carries a named identity.
  3. Make alarms and logs read one way Send them one direction to a store the operator screen cannot reach, so a compromised session blinds nobody and the owner has its own log to answer a claim.
The Trout Pond
Podcast · Joe and Cam · 9:13
TwoNet Water Honeypot Short
Video · 60 to 90 seconds

Sources: Forescout Vedere Labs, “Anatomy of a Hacktivist Attack,” 9 Oct 2025; AA25-343A, 9 Dec 2025; NVD CVE-2021-26829; The Record, 10 Oct 2025; Dale Peterson, “Water Treatment Honeynet Incident Analysis,” 14 Oct 2025. Full list with links.

Soft Spots: One witness: the log is Forescout’s, published once. “A Dutch water facility” is The Record’s account; the Telegram post is unseen. That the alarm switch is the dangerous action is BlastWave’s analysis.

The full record

Every claim numbered to its source. Last updated .

A hacktivist group told Telegram it had disrupted a water plant; the plant was a research decoy, and no real facility was touched. What is verified, what is only reported, and what is still unknown.

Summary

In September 2025, the hacktivist group TwoNet logged into what it took to be a water treatment plant's operator screen with the default password, defaced it, changed setpoints and disabled logs and alarms, then claimed a real-world attack on Telegram. The plant was a honeypot built and watched by Forescout researchers. No real water facility was touched.1

Timeline of the TwoNet honeypot intrusion

Every date is tied to a source. Press reporting appears only as evidence of what was said.

  1. TwoNet first appears on Telegram, according to Intel 471 as cited by Forescout.1 The Record later reports the group surfaced that month and is "believed to have around 40 members."4
  2. Separate activity, not TwoNet: Forescout logs coordinated scanning and tampering against its PLC honeypots from four Iranian-registered addresses, using Metasploit Modbus modules plus additional scripts.1
  3. Separate activity, not TwoNet: Forescout logs a webshell uploaded to one of its honeypots.1
  4. TwoNet's first Telegram channel is banned.1
  5. TwoNet begins using a new Telegram channel.1
  6. The group's first claim against control systems, solar-plant control panels, appears on the new channel.1
  7. The intrusion into Forescout's decoy water utility begins at 8:22 AM with the default password. The intruder creates the BARLATI account, first logs in with it at 3:20 PM, and last logs in at 11:19 AM the following morning. The group then claims a real-world attack on Telegram.1
  8. A message in an allied group's chat (CyberTroops) says TwoNet is ceasing operations.1
  9. Forescout publishes the log and says the group "falsely claimed responsibility for a real-world attack."1 The same day, SC Media quotes a commentator calling Russian hacktivism "a formidable asymmetric warfare capability."5
  10. The Record reports that TwoNet had claimed in September that it had disrupted a Dutch water facility. The Register, Infosecurity Magazine and Industrial Cyber report the incident with differing durations or none.6,7,8,9
  11. Dale Peterson publishes an analysis noting the attribution rests on the group's own chat and questioning how realistic the honeynet was.10 TechRadar's lead sentence says TwoNet "recently breached a Dutch water facility organization"; a few paragraphs later it says the organization "does not exist."11
  12. CISA adds CVE-2021-26829, the flaw used for the defacement, to its Known Exploited Vulnerabilities catalog. No document we read links the addition to this incident.3
  13. FBI, CISA, NSA and partners publish AA25-343A on pro-Russia hacktivists. It names four other groups, not TwoNet.2
  14. An incident database record, updated this day, says the attacker spent "roughly 30 minutes" inside and describes Metasploit and Modbus activity that Forescout attributes to the February attackers.12

Key facts and their status

Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.

QuestionWhat the record saysStatus
Was a real water facility affected?No. The only facility in the record is Forescout's decoy1Verified
How did the intruder get in?Default credentials, admin/admin, on the internet-facing operator screen1Verified (one witness: the honeypot log)
What did the intruder do on the decoy?Defaced the login page, deleted controllers as data sources, changed setpoints, disabled logs and alarms1Verified (one witness)
How long was the intruder present?First access 8:22 AM; last login 11:19 AM the following morning. No time zone given1Verified (one witness)
Was it "thirty minutes"?Not in the log. The figure comes from an incident database record updated in April 20261,12Not supported by the log
Who claimed it?TwoNet, on Telegram1Verified (self-claim)
Did the claim name a Dutch facility?So The Record reports. The post itself has not been published6Reported only
Has any government attributed it?No. AA25-343A names four other groups, not TwoNet2Verified (as of December 2025)
Was malware used?None reported. A known web flaw, CVE-2021-26829, was used to deface1,3Verified
Which day in September?Not given by ForescoutUndisclosed
Who was behind the BARLATI account?Not publicly identifiedUndisclosed

Was a real water treatment plant hacked by TwoNet?

No. The water treatment plant TwoNet claimed was a honeypot, a decoy built and watched by Forescout's researchers, and no real facility was touched. Forescout's account is that the group targeted its "water treatment utility" honeypot and then "falsely claimed responsibility for a real-world attack" on its Telegram channel.1 Forescout called the case a first for its honeypot network:

"This is the first time a group has publicly claimed an attack that we can confirm occurred on one of our honeypots."
Forescout Research, Vedere Labs, 9 October 20251

What the group actually posted has not been published. Forescout does not reproduce the Telegram post, and we have not seen it. That the claim named a Dutch water facility is The Record's account: the group "claimed in September that it had disrupted a Dutch water facility," it reported on 10 October 2025.6 Forescout's own text does not mention the Netherlands.1 Any sentence that names the claimed target without saying it was a honeypot repeats the group's publicity for it.

How did the intruder get into the honeypot?

With the default username and password, admin/admin, on an operator screen reachable from the internet. According to Forescout's log, the intrusion began at 8:22 AM from an address registered to a German hosting provider (AS58212).1 The intruder ran database queries through the screen to learn its structure, created a new user account named BARLATI, and first logged in with it at 3:20 PM, "about seven hours after the initial compromise." The last login came "the following morning at 11:19 AM."1

Forescout gives the month and clock times but not the day of the intrusion or the time zone of its timestamps. The visit spanned two calendar days, roughly a day and three hours by arithmetic on those times. No exploit against the underlying machine was needed: Forescout reports the attacker did not attempt privilege escalation or exploitation of the underlying host, and worked only at the web application layer of the operator screen.1

What did the intruder actually do inside the decoy?

Four things, and in BlastWave's reading the most serious was switching off the logs and alarms. Forescout's log lists these actions during the BARLATI account's window:1

  • Defacement. The login page was defaced using CVE-2021-26829, an old stored cross-site scripting flaw.1,3
  • Process disruption. The connected controllers were deleted as data sources, which stopped real-time updates.1
  • Manipulation. Controller setpoints were changed through the operator screen.1
  • Evasion. System settings were changed to disable logs and alarms.1

None of this reached a real process, because there was none. It is still not "just a defacement." The log records setpoint changes and the alarms and logs turned off from the same web screen the intruder had logged into.1 What those actions would have achieved against a working plant is a separate question the log cannot answer: Dale Peterson cautions that how realistic the honeynet was limits what it shows about skill.10

Who is TwoNet, and has anyone attributed the intrusion?

TwoNet is a hacktivist group that claimed the intrusion itself; no government has attributed it. Forescout names TwoNet because the group claimed the intrusion on Telegram and the claim matched Forescout's log.1 Forescout describes the group as Russia-aligned and the press as pro-Russian; those are descriptions of its stance, not a state attribution.

"The attribution to TwoNet is based on claims in a chat."
Dale Peterson, "Water Treatment Honeynet Incident Analysis," 14 October 202510

Per Intel 471 as cited by Forescout, TwoNet first appeared on Telegram in January 2025 doing denial of service; that channel was banned on 7 March. A new channel started on 14 September, claims against control systems followed from 15 September, and on 30 September a message in an allied group's chat said TwoNet was ceasing operations.1 The part of the story people remember lasted about sixteen days.

The December 2025 joint advisory on pro-Russia hacktivists, AA25-343A, does not name TwoNet. It names CARR, NoName057(16), Z-Pentest and Sector16, and describes the pattern this incident illustrates: such groups "regularly make false or exaggerated claims about their attacks on critical infrastructure to garner more attention."2 Forescout draws its own comparison:

"As with the early CyberAv3ngers playbook, groups moving from DDoS/defacement to OT/ICS often misread targets, trip over honeypots, or over-claim."
Forescout Research, Vedere Labs, 9 October 20251

Why do accounts of the TwoNet incident disagree?

Because retellings drifted in both directions from a single log: one shrank the visit to thirty minutes, another inflated it into a strategic capability. There is one primary record, and only some of the durations in later accounts are consistent with it.

  • SC Media, 9 October 2025, quoted a Deepwatch director: "Russian hacktivism has evolved into a formidable asymmetric warfare capability."5
  • The Register, 10 October 2025, said "within 26 hours," consistent with the log.7
  • Infosecurity Magazine, 10 October 2025, said "approximately 20 hours" after the account was created, also consistent with it.8
  • Industrial Cyber, 10 October 2025, quoted Forescout's timestamps and gave no duration.9
  • TechRadar, 14 October 2025, led with TwoNet having "recently breached a Dutch water facility organization" and said a few paragraphs later that "the Dutch water facility organization does not exist."11
  • An incident database record updated 29 April 2026 says "roughly 30 minutes," reports that TwoNet framed the target as a real US water utility, and describes Metasploit and Modbus activity.12

The Metasploit modules and Modbus writes belong to different activity in the same Forescout post: coordinated scanning and tampering from four Iranian-registered addresses between 21 and 25 February 2025, months before TwoNet's intrusion.1 Folding that activity into the TwoNet story produced the Modbus-writing version. The thirty-minute figure is not in the log.1,12

What is still not known about TwoNet Water Honeypot

  • The text of TwoNet's Telegram claim. Forescout has not published it, and we have not seen it. That it named a Dutch water facility comes from reporting.6
  • The day of the intrusion and the time zone of Forescout's timestamps.
  • Who was behind the BARLATI account, and whether anyone has been identified. No government document names TwoNet.2
  • How closely the decoy resembled a working plant. That is Forescout's to describe, and it has not published the design.10
  • Which software the decoy ran. That it was ScadaBR is BlastWave's inference from the CVE Forescout names; Forescout does not say so in its TwoNet section.1,3
  • Whether any of the group's other September claims, such as the solar-plant control panels, were real. None has been tested in public.
  • Whether any outlet repeated the claim as a real incident before Forescout's post of 9 October 2025. Our search found no press report that did.

Claims about TwoNet Water Honeypot the record does not support

Widely repeated claimWhat the record says
"TwoNet hacked a Dutch water utility."The only facility in the record is Forescout's decoy. Forescout says the group "falsely claimed responsibility for a real-world attack." The Dutch detail is The Record's account of the claim.1,6
"The attacker spent about thirty minutes inside."The log runs from first access at 8:22 AM to a last login at 11:19 AM the following morning.1 The thirty minutes appears in an incident database record, not in the log.12
"It was a real US water utility."That is how TwoNet framed it, as the incident database record itself reports. The target was a decoy.1,12
"TwoNet used Metasploit and Modbus writes on the plant."Forescout attributes that activity to four Iranian-registered addresses, 21 to 25 February 2025, not to TwoNet.1
"It was just a defacement."The log lists four actions: a defaced login page, controllers deleted as data sources, setpoints changed, and logs and alarms disabled.1
"Russia attacked a water plant."TwoNet claimed the intrusion itself. "Russia-aligned" is Forescout's description of the group's stance. No government document names TwoNet.1,2,10

Did any government action follow?

Nothing that names this incident. CVE-2021-26829, the flaw used for the defacement, was added to CISA's Known Exploited Vulnerabilities catalog on 28 November 2025, seven weeks after Forescout's post.3 That is sequence, not cause: no document we read links the two. AA25-343A, published 9 December 2025, describes false or exaggerated hacktivist claims in general and does not name TwoNet.2

BlastWave analysis: the narrator lied about the target, not the method

Analysis, not a disclosed fact

Many hacktivist claims arrive as the only witness: a screenshot, a caption, a boast. TwoNet is the rare case where the other side kept a record. The group lied about the target. It did not obviously lie about the method. The log shows setpoints changed, the controllers cut off as data sources, and the logs and alarms switched off from the same web screen it had logged into.1 The method in this log works on any real operator screen left on the internet with its default password. That is BlastWave's analysis rather than a disclosed fact, and a decoy cannot show what the method would have achieved against a real process.10

The dangerous action in this log is not the defacement but the switch that turned off the alarms and logs. This is also BlastWave's analysis rather than a disclosed finding. A honeypot is how the truth is known here at all, because its builders kept a record the intruder could not reach. A plant whose record can be erased from its own operator screen cannot answer a claim like this one. It can only hope the claim is false.

How BlastWave removes the paths an attacker uses to reach OT

Listen and watch

Podcast: “The Trout Pond” (9:13). Joe Baxter and Cam Cullen on why a group that lied about the target did not obviously lie about the method.

Video: TwoNet Water Honeypot Short (60 to 90 seconds).

Frequently asked questions

What happened in the TwoNet water honeypot incident?

In September 2025, the hacktivist group TwoNet logged into what it took to be a water treatment plant's operator screen using the default password admin/admin. It defaced the login page, changed setpoints and disabled logs and alarms, then claimed a real-world attack on Telegram. The plant was a honeypot built and monitored by Forescout's Vedere Labs, which published the log on 9 October 2025. No real water facility was touched.

Did TwoNet hack a real Dutch water facility?

No. The only facility in the record is Forescout's decoy water utility. The Record reported on 10 October 2025 that TwoNet had claimed in September to have disrupted a Dutch water facility, but Forescout says the group falsely claimed a real-world attack, and its own post does not mention the Netherlands. The text of the Telegram post has not been published.

How did TwoNet get into the water plant honeypot?

According to Forescout's log, the intruder logged into the decoy's internet-facing operator screen at 8:22 AM with the default credentials admin/admin, from an address at a German hosting provider. It queried the database through the screen, created an account named BARLATI, first used it at 3:20 PM and last logged in at 11:19 AM the following morning. It did not attack the underlying machine.

How long were the attackers inside the TwoNet honeypot?

Forescout's log runs from first access at 8:22 AM to a last login at 11:19 AM the following morning, with no time zone given. The Register's "within 26 hours" is consistent with that. An incident database record updated in April 2026 says roughly thirty minutes, which the log does not support.

Is TwoNet linked to the Russian government?

No government has attributed the intrusion. Forescout names TwoNet because the group claimed it on Telegram, and Dale Peterson noted on 14 October 2025 that the attribution rests on claims in a chat. Forescout calls the group Russia-aligned, which describes its stance. The December 2025 joint advisory AA25-343A on pro-Russia hacktivists names four other groups and does not name TwoNet.

Did TwoNet use Metasploit or Modbus against the water plant?

Not according to Forescout. Its 9 October 2025 post describes Metasploit Modbus modules used by four Iranian-registered addresses against its PLC honeypots between 21 and 25 February 2025, months earlier. TwoNet's intrusion in September worked only through the decoy operator screen's web interface. Retellings that give TwoNet Modbus writes have merged the two.

If the plant was fake, why does the TwoNet incident matter for real water utilities?

In BlastWave's analysis, the group lied about the target but not obviously about the method. Forescout's log shows a default password on an internet-facing operator screen was enough to change setpoints and switch off alarms and logs. A real plant exposed the same way would face the same method. A decoy cannot show what that would achieve against a working process, which Dale Peterson also cautions.

CyberAv3ngersThe comparison Forescout itself draws: there a claimed defacement met real devices and a real utility; here a claimed disruption met a decoy.US Water CampaignThe real-world version of this method: internet-facing controllers and screens at small utilities, where owners and government did have to answer.ZionSiphonThe sibling non-incident: there the artifact was real and could not do what its authors intended; here the intrusion was real and the victim was not.

Sources

The primary record is the honeypot operator's own published log, read alongside government documents and named researchers' analysis. Press and incident-database retellings are cited only as evidence of what was said.

  1. ResearcherForescout Research, Vedere Labs, "Anatomy of a Hacktivist Attack: Russia-Aligned Group Targets OT/ICS," 9 October 2025. The honeypot operator's log and the only primary record of the intrusion: the TwoNet section, the group's history, and the separate February and March activity. forescout.com
  2. FederalFBI, CISA, NSA and partners, Joint Cybersecurity Advisory AA25-343A, "Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure," 9 December 2025. PDF · IC3 copy (PDF)
  3. GovernmentNIST National Vulnerability Database, CVE-2021-26829 ("OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm"), published 11 June 2021; added to CISA's Known Exploited Vulnerabilities catalog 28 November 2025. nvd.nist.gov · CISA KEV catalog
  4. PressDaryna Antoniuk, The Record, 3 July 2025. Reporting on the group, not the incident. therecord.media
  5. PressSteve Zurier, SC Media, 9 October 2025, quoting Frankie Sclafani, Director of Cybersecurity Enablement, Deepwatch. Cited as evidence of what was said. scworld.com
  6. PressDaryna Antoniuk, "Pro-Russian hackers caught bragging about attack on fake water utility," The Record, 10 October 2025. Cited as evidence of what was said, including the reported wording of TwoNet's claim. therecord.media
  7. PressConnor Jones, The Register, 10 October 2025 ("within 26 hours"). Cited as evidence of what was said. theregister.com
  8. PressJames Coker, "Pro-Russia Hacktivists 'Claim' Attack on Water Utility Honeypot," Infosecurity Magazine, 10 October 2025 ("approximately 20 hours" after the account was created). Cited as evidence of what was said. infosecurity-magazine.com
  9. PressAnna Ribeiro, Industrial Cyber, 10 October 2025. Quotes Forescout's timestamps (first access at 08:22, last login "the following morning at 11:19 AM") and gives no duration. Cited as evidence of what was said.
  10. ResearcherDale Peterson, "Water Treatment Honeynet Incident Analysis," 14 October 2025. dale-peterson.com
  11. PressSead Fadilpašić, "Pro-Russian hackers tricked into attacking decoy target," TechRadar, 14 October 2025. Cited as evidence of what was said. techradar.com
  12. PressRISI (Repository of Industrial Security Incidents), "Forescout honeypot exposes how the TwoNet hacktivist group manufactured a fake water-utility victory," record updated 29 April 2026. An incident database record, cited as evidence of how the story drifted, not of the incident. risidata.com

Cite this page

BlastWave. “TwoNet Water Plant Honeypot Intrusion (2025): What Is Verified.” Hackopedia, Volume 2, FILE 027. Last verified 2 October 2026. https://hackopedia.blastwave.com/water/twonet-water-honeypot-2025/

Revision history

DateChange
6 Oct 2026Numbered FILE 027 in Hackopedia Volume 2, in the Water edition.
2 Oct 2026Industrial Cyber's 10 October 2025 report checked against its text: it quotes Forescout's timestamps and states no duration.
28 Sep 2026Press accounts re-read at source (The Record, The Register, SC Media and the incident database record). Corrected our wording so the "real US water utility" framing is attributed to TwoNet, as the record reports it, and so The Record is quoted in its own words.
26 Sep 2026Full verification against Forescout's post, AA25-343A, the NVD and KEV entries, Dale Peterson's analysis and TechRadar. Corrected an overstatement about where Forescout's post mentions ScadaBR, and softened a claim about how many hacktivist incidents rest on the attacker's word alone.
24 Sep 2026Volume 2 entry built from Forescout's published log and primary sources.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry