Infrastructure Destruction Squad: Analysis of BLACKNET-00 and ICS Tooling

Infrastructure Destruction Squad, also known as BLACKNET-00, is a low-maturity but operationally disruptive actor cluster specializing in access brokerage, ransomware, and ICS reconnaissance. The group leverages functional modules for Firebase misconfiguration discovery and industrial protocol scanning (Modbus, S7comm) embedded within otherwise incomplete or AI-assisted GUI wrappers. Their activities appear commercially motivated, advertising DDoS-as-a-Service and selling initial access while maintaining an ideological hacktivist branding.

Technically, the cluster's tooling is uneven. Their BLACKNET-00 ransomware utilizes weak, reversible XOR encryption that permits straightforward recovery, yet remains effective at disruptive persistence and victim intimidation. More significantly, their TRK-25 toolkit facilitates targeted reconnaissance of internet-exposed Industrial Control Systems (ICS), specifically targeting public IP ranges and leveraging product-specific fingerprints for platforms like FactoryTalk and WinCC.

This activity is particularly concerning for the Water and Wastewater Systems sector, as the group demonstrates a clear intent to identify and exploit internet-facing PLCs and HMIs. Organizations should prioritize removing OT infrastructure from the open internet and auditing Firebase deployments for permissive access rules to mitigate the primary risks posed by this actor's verified capabilities.