The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog to include a security flaw impacting OpenPLC ScadaBR, citing evidence of active exploitation.
The vulnerability in question is CVE-2021-26829 (CVSS score: 5.4), a cross-site scripting (XSS) flaw that affects Windows and Linux versions of the software via system_settings.shtm. It impacts the following versions –
- OpenPLC ScadaBR through 1.12.4 on Windows
- OpenPLC ScadaBR through 0.9.1 on Linux
The addition of the security defect to the KEV catalog comes a little over a month after Forescout said it caught a pro-Russian hacktivist group known as TwoNet targeting its honeypot in September 2025, mistaking it for a water treatment facility.
In the compromise aimed at the decoy plant, the threat actor is said to have moved from initial access to disruptive action in about 26 hours, using default credentials to obtain initial access, followed by carrying out reconnaissance and persistence activities by creating a new user account named “BARLATI.”
The attackers then proceeded to exploit CVE-2021-26829 to deface the HMI login page description to display a pop-up message “Hacked by Barlati,” and modify system settings to disable logs and alarms unaware that they were breaching a honeypot system.
 |
| TwoNet Attack Chain |
“The attacker did not attempt privilege escalation or exploitation of the underlying host, focusing exclusively on the web application layer of the HMI,” Forescout said.
TwoNet began its operations on Telegram earlier this January, initially focusing on distributed denial-of-service (DDoS) attacks, before pivoting to a broader set of activities, including the targeting of industrial systems, doxxing, and commercial offerings like ransomware-as-a-service (RaaS), hack-for-hire, and initial access brokerage.
It has also claimed to be affiliated with other hacktivist brands such as CyberTroops and OverFlame. “TwoNet now mixes legacy web tactics with attention-grabbing claims around industrial systems,” the cybersecurity company added.
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary fixes by December 19, 2025, for optimal protection.
OAST Service Fuels Exploit Operation
The development comes as VulnCheck said it observed a “long-running” Out-of-Band Application Security Testing (OAST) endpoint on Google Cloud driving a regionally-focused exploit operation. Data from internet sensors deployed by the firm shows that the activity is aimed at Brazil.
“We observed roughly 1,400 exploit attempts spanning more than 200 CVEs linked to this infrastructure,” Jacob Baines, VulnCheck CTO, said. “While most of the activity resembled standard Nuclei templates, the attacker’s hosting choices, payloads, and regional targeting did not align with typical OAST use.”
The activity entails exploiting a flaw,…
Source link
Disclaimer
We strive to uphold the highest ethical standards in all of our reporting and coverage. We blogs.grocliq.com want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It’s possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.
Website Upgradation is going on for any glitch kindly connect at [email protected]
