TARGET: 116.255.61.112
RISK LEVEL: LOW (Score: 15/100)
SYSTEM TYPE: VNC Remote Desktop

OPEN SERVICES:
- VNC: 5900

VULNERABILITIES FOUND:
- VNC may have no authentication or weak password

EXPLOITATION METHODS:
- VNC remote access
- Screen capture
- Keyboard control
- Remote desktop takeover

[!] VNC ACCESS GRANTED!
Password:
Port: 5900

Quick Connect: vncviewer 116.255.61.112:5900

Hello

We will soon resume operations targeting industrial systems and today we announce the beginning of a new phase of our activities aimed at critical infrastructure in several countries around the world.

Stay tuned. Sensitive facilities within the United States India and European Union member states will be targeted with a focus on industrial facilities power plants water networks and industrial control systems.

We will use the advanced VoltRuptor ICS tool which is specifically designed to compromise SCADA systems and PLCs. It is capable of remotely controlling industrial equipment disrupting pumps and valves altering pressure and temperature readings and potentially causing physical damage to equipment

Based on our exfiltrated data from Mahanagar Gas Limiteds systems we have a list of stations that we can completely destroy at any moment we choose including Nahur Station Vashi CBD Belapur Nerul Turbhe Ghansoli Airoli Rabale Kopar Khairane as well as other substations spread across the greater Mumbai area all of these stations are connected to our network and we can easily access their routers and control systems

If we deploy a malicious script inside their systems to raise the temperature the impact will be catastrophic and immediate we will start by gradually increasing temperature readings to avoid triggering early warning systems then suddenly spike them to dangerous levels exceeding safety limits which will cause gas expansion and pressure build up within transmission lines eventually leading to valve explosions or pipeline ruptures resulting in massive gas leaks into residential areas and nearby factories endangering thousands of lives and causing immense property damage

The damage will not be limited to physical destruction but will also include cutting off gas supplies to millions of homes and businesses disrupting gas dependent power plants leading to widespread electricity blackouts paralysis of transportation networks and shutdown of factories hospitals and essential facilities all of this could happen within hours if we decide to execute our plan and we have the capability to activate it remotely from anywhere in the world

We are not just making threats we are presenting a clear warning based on our real capabilities proven by our access to their systems extraction of their data and exposure of their vulnerabilities the company has only one choice which is to cooperate with us and pay the required amount within the deadline otherwise we will be forced to carry out what we say and everyone will witness what happens when our warnings are ignored

Only 75 hours remain and after that we will begin destroying all control devices and vital equipment at the gas stations belonging to Mahanagar Gas Limited using our advanced tool VoltRuptor ICS which is specifically designed to penetrate and disable SCADA and PLC industrial systems

This tool gives us full control over every device connected to their networks from pressure valves to temperature sensors from transfer pumps to safety systems once activated we will send malicious commands to the programmable logic controllers which will disable measurement devices suddenly alter pressure readings raise temperatures to unsafe levels shut down cooling and ventilation systems and all of this will cause cascading failures that cannot be controlled

The damage will not be limited to the targeted stations but will extend to the entire transmission network leading to gas supply cuts to millions of homes businesses and factories disruption of gas dependent power plants paralysis of transportation networks shutdown of hospitals and essential facilities and all of this will have catastrophic humanitarian and economic consequences

We are giving them a final chance during the next 75 hours to contact us and pay the required amount and if that does not happen we will activate VoltRuptor ICS across all stations we have access to and the entire world will witness what happens when our warnings are ignored the decision is now in their hands and time is running out fast

blacknet00x@gmail.com

@blacknetransom

This is one of the buyers of ransomware programs, specifically for building

This is also one of the buyers of ransomware programs

The tool has been updated and more advanced features have been added against industrial systems TRK25 ADVANCED SCADA

wow

A cyber attack was carried out against an industrial control system of a hydroelectric power plant in France. Access was gained to the plant's primary control interface (VNC) after exploiting a vulnerability in exposed network protocols. The system was completely taken offline and disabled.

The target was a hydroelectric generation facility operating on a 20 kV network, consisting of two main generation units, G1 and G2. Unit G1 produces 568 kW while Unit G2 produces 15,404 kWh daily, supported by power factor correction capacitors rated at 60 kVAR each. Instrumentation readings for reservoir level, head height, and flow rate confirmed the plant's dependence on water head pressure for power generation.

Entry was achieved through the VNC port using a high-speed DDoS tool with instant start and no latency. The attack employed UDP Flood with IP spoofing, utilizing 200 concurrent threads at a sustained rate of 6,800 requests per second. Over 965 MB of malicious traffic had been transmitted at the time of reporting, with the attack running in infinite duration mode.

The impact included complete disruption of the monitoring and control systems, total loss of VNC connectivity resulting in full loss of generator control, frozen operational data showing stuck readings of 0584 kW and -091 kVAR, unresponsive start/stop controls, and repeated failed connection attempts logged from the main control room.

Be aware that malicious software will be implanted within stations to disable all stations