🚨🌐 GLOBAL CYBER RISK FORECAST | Pro-Russian and pro-Iranian influence targeting the West, the United States, and critical infrastructure
VECERT analyzed over 179 public claims, posts, and signs of activity related to SCADA/ICS systems, industrial networks, water and energy utilities, telecommunications, municipal infrastructure, and propaganda narratives.
Analytical breakdown of exposure by sector
The following weighting represents the relative risk observed in the reviewed material; it does not reflect the percentage of confirmed attacks:
🔴 35% — Energy and essential utilities: heating networks, substations, fuel, gas systems, energy generation, and monitoring.
🔴 27% — Industry and manufacturing: HMIs, processing plants, automation, packaging, industrial machinery, CNC systems, and logistics operations.
🔴 20% — Water and sanitation: treatment plants, irrigation, drainage, reverse osmosis, pumping, municipal networks, and drinking water services.
🟠 10% — Telecommunications and connectivity: fiber providers, network systems, management platforms, and critical communication services.
🟠 8% — Public services and facilities: municipal portals, building management, HVAC, public infrastructure, and peripheral control systems.
The most significant trend is clear: threat actors are not merely seeking data. The exposure of an HMI, a SCADA console, or a management panel can serve as a vector for operational disruption, psychological pressure, propaganda, or reputational damage.
Most likely methods of occurrence
Based on observed activity, VECERT estimates the following risk composition for the coming days:
• 32% — Espionage and credential theft: initial access, harvesting of user accounts, passwords, internal network details, and operational data.
• 28% — DDoS and service disruption: attacks targeting portals, telecommunications, public services, and public-facing platforms. • 24% — Risk of industrial disruption / SCADA: exposure of HMI panels, water systems, energy, heating, fuel, or manufacturing systems.
• 16% — Cyberterrorism and psychological operations: campaigns designed to incite fear, amplify narratives, claim responsibility for incidents, or undermine public trust.
Actors and patterns requiring heightened attention
"Handala" appears in open sources as a name frequently associated with an anti-Israeli narrative and, according to various public assessments, with pro-Iranian influence or alignment. Monitored material includes references to water infrastructure in California and potential physical targets. While these claims require independent validation, the associated narrative combines psychological pressure, the exposure of targets, and messaging with geopolitical implications.
"NoName057" is widely recognized in open sources for its pro-Russian stance and its use of disruptive campaigns, particularly DDoS attacks. The materials reviewed also contain claims linked to water systems, irrigation, osmosis, heating, industrial facilities, and SCADA environments. The shift from a narrative focused on digital disruption toward one targeting operational infrastructure warrants attention.
"Infrastructure Destruction Squad" is notable for focusing on systems with potential physical impact, such as water, heating, agriculture, perimeter control, and fuel monitoring. While state affiliation should not be assumed without verifiable evidence, the nature of these targets is particularly sensitive, as they could affect essential services.
"WAY-KURAP" focuses its posts on energy, heating networks, industrial plants, water, telecommunications, and infrastructure monitoring. Although available material does not confirm a specific geopolitical alignment, the group’s recurring presence within OT/ICS environments makes it a priority actor for monitoring.
"Team1914" has been linked to claims regarding water infrastructure in Tel Aviv. The observed activity includes an anti-Israeli component; however, given the limited public evidence, it should not be automatically classified as pro-Iranian or attributed to a state-sponsored entity. Disrupt0r and other names appearing in the analyzed posts show an interest in industrial systems and exposed infrastructure. The primary concern is not just the possibility of intrusion; it also involves the publication of screenshots, dashboards, locations, or alleged evidence that could facilitate further campaigns involving pressure, reconnaissance, or propaganda.
Posts by "313 Team" combine DDoS attacks, political messaging, threats of continued activity, and claims of high-impact actions against public-facing services. Based on their narrative, target selection, and ideological references, this group should be viewed as potentially aligned with Iran or the "Axis of Resistance"—though any operational or state-level connection remains unconfirmed, pending further technical evidence.
"Cyber Squad 313 PK" has claimed responsibility for actions against French universities, including domains linked to institutions in Limoges, Montpellier, Cergy-Pontoise, Panthéon-Sorbonne, and Bordeaux. The presence of the number "313" is not sufficient to confirm that this is the same entity as "313 Team." It should be tracked as a distinct actor until there is evidence of coordination, shared infrastructure, or common communication channels.
"GORZ ROSTAM" warrants particular attention due to its selection of targets related to physical infrastructure and high-impact services. Its posts include claims targeting water-sector entities in the United States—such as the Colorado Water Conservation Board, Veolia North America, and the American Water Works Association—as well as references to financial institutions and technology platforms. This pattern elevates the risk of propaganda campaigns and DDoS attacks directed at water, sanitation, and public administration services. There is insufficient evidence to definitively classify this actor as pro-Iranian.
Countries with the highest level of exposure—based on analysis—over the next 7–14 days:
🇺🇸 United States
🇬🇧 United Kingdom
🇫🇷 France
🇩🇪 Germany
🇵🇱 Poland
🇺🇦 Ukraine
🇮🇱 Israel
Additional areas under surveillance: 🇨🇦 Canada, 🇪🇸 Spain, 🇮🇹 Italy, 🇷🇴 Romania, the Baltic region, and the Gulf countries.
The United States remains the most sensitive target due to a combination of geopolitical visibility, distributed critical infrastructure, connected municipal services, and high propaganda value.
Israel remains under pressure due to the convergence of anti-Israeli activity, cyber-espionage, propaganda, and threats against physical services.
Western and Eastern Europe face elevated risk due to their relevance in the Russia-Ukraine context, their energy infrastructure, and their reliance on cross-border services.
Entities that should immediately increase monitoring:
• Operators of drinking water, sanitation, irrigation, and pumping systems
• Electric utility companies, substations, and providers of gas, fuel, and heating
• Telecommunications, fiber optics, backbone networks, and regional service providers
• Municipalities, emergency response systems, public-facing portals, and Building Management Systems (BMS)
• Industrial plants, manufacturing, logistics, Human-Machine Interfaces (HMI), and Industrial Control System (ICS) networks
• Organizations with assets exposed to the Internet, remote access points, or reused credentials
Conclusion: Today’s digital warfare is not limited to the theft of information. Physical infrastructure has become a high-value target for espionage, disruption, propaganda, and geopolitical pressure. Defense strategies must operate on the assumption that an exposed console, a leaked password, or a poorly segmented municipal service can rapidly escalate into an incident with public-facing impact.
#VECERT #CyberThreatIntelligence #CTI #Cybersecurity #SCADA #ICS #CriticalInfrastructure #Cyberterrorism #CyberEspionage #DDoS #Russia #Iran #UnitedStates #Europe