Sector16

Sector16 is a pro-Russia hacktivist group formed in January 2025 through collaboration with Z-Pentest. It is described as a newer, relatively inexperienced operator set that nevertheless achieves access through opportunistic methods, especially stolen credentials, weak authentication controls, password spraying, default or weak credentials, and exploitation of poorly secured, internet-facing remote access to operational technology environments, particularly VNC access to HMI devices. Sector16 has been publicly identified alongside Cyber Army of Russia Reborn (CARR), Z-Pentest, and NoName057(16) in joint U.S. and international advisories as targeting critical infrastructure organizations worldwide, including the water and wastewater, food and agriculture, energy, and in some reporting aviation sectors, as well as government services. Reported impacts include temporary loss of view, operational disruption, remediation costs, and in some cases physical damage, while the group and related actors often exaggerate impacts for publicity. Sector16 maintains a public Telegram channel where it shares videos, statements, and claims of compromising U.S. energy infrastructure, and it is described as prioritizing hack-and-leak operations for publicity. The content states its messaging aligns with pro-Russia narratives, and that members may have received indirect Russian government support in exchange for operations aligned with Russian strategic goals. Known alias in the provided content: sector16.