A New Russian Cybercriminal Group Targets U.S. Oil and Gas Facilities

Named Sector 16, it collaborates with Z-Pentest, another Kremlin-linked group targeting critical infrastructure.

On January 31, 2025, cybersecurity firm Cyble detailed the activities of a new cybercriminal group linked to the Russian government, called “Sector 16.” This entity has recently targeted oil and gas facilities in the United States and works with another Russian cybercriminal group, Z-Pentest. Emerging in 2024, Z-Pentest focuses on attacking Western critical infrastructure, particularly in the water and energy sectors.

Sector 16 has claimed responsibility for two cyberattacks compromising industrial control panels. The first, conducted jointly with Z-Pentest, targeted an oil facility in Texas, specifically its SCADA system controlling pumps and storage tanks. The two groups released a video showing the hacked control panel interface, displaying real-time data on tank levels, pump pressures, and alarm management.

Sector 16 then claimed sole responsibility for hacking another U.S. oil and gas production facility. The cybercriminal group published a video allegedly proving, according to Cyble, its access to the facility’s operational data and critical systems.

In both cases, the intrusions did not result in operational disruptions. The attackers likely aimed to showcase their disruptive capabilities as a means of destabilization.