The immediate safety risk is unauthorized operator-level control: a false command can trip refrigeration, pumps, ventilation, or treatment equipment; a missed or suppressed command can leave an unsafe process running. Fact: CISA says these actors exploited minimally secured, internet-facing VNC sessions to reach OT controls, with impacts ranging from access attempts to physical damage. Rewards for Justice documents minor process disturbances and one water operator switching to manual operation to defeat attempted access. Unknown: the available evidence does not independently establish every claimed burst main, fire, refrigeration failure, or climate-control event, nor prove that treatment logic, safety functions, or product integrity changed in each intrusion. Videos or HMI screenshots demonstrate visibility—and sometimes command execution—not necessarily the claimed physical consequence.
Tonight, in order: (1) put affected sites into a safety incident posture: add operator coverage, verify critical pressures, temperatures, levels, dosing and alarms locally, and use manual operation only under an approved procedure; (2) block direct internet access to VNC at the perimeter without rebooting controllers or disrupting HMI-to-PLC communications; (3) preserve firewall/NAT, VNC, VPN and Windows logs, screenshots, packet captures, historian trends, alarm journals and controller project/checksum data before changing credentials; and (4) compare PLC logic, setpoints, outputs, schedules and operating modes against known-good engineering records. In Purdue terms, exposed VNC is commonly an entry into the Level 2 operator/HMI plane; the key question is whether valid commands or downloaded logic then reached Level 1 controllers. Treat SIS communications separately—a segmentation change that causes a false trip or blocks a required trip may create the worse hazard.
Tomorrow: remove every direct VNC exposure, place remote access behind a monitored jump host or VPN with MFA and named accounts, rotate credentials after evidence capture, review vendor accounts, and inventory similar exposure across every site. Validate firewall and segmentation changes in a representative test environment before production rollout. This is not primarily a “patch within 24 hours” problem: containment, authenticated remote access and command-integrity review come first; firmware or HMI updates should follow vendor validation and the plant maintenance process.
On attribution, weak or default credentials establish opportunity, not GRU tasking. CISA describes the ecosystem as pro-Russian but also says Z-Pentest was created by dissatisfied CARR and NoName057(16) administrators using similar tactics while operating separately from GRU involvement. Rewards for Justice reports CARR’s claimed Russian-government connections and calls it a Russian proxy, but those facts do not prove that every VNC intrusion was directed, selected or approved by the GRU. My assessment is pro-Russian operational alignment with possible state relationships; GRU-directed sabotage requires additional command-and-control, tasking, infrastructure or human-source evidence.