The pro-Russian hacktivist group TwoNet mistakenly believed they had successfully attacked a Dutch water facility, when in fact they had infiltrated a honeypot set up by cybersecurity firm Forescout. This decoy was designed to mimic critical infrastructure and study attacker behavior. TwoNet’s intrusion involved tampering with system settings and disabling alarms, actions that could have been disruptive if executed on a real system. The incident highlights the growing trend of hacktivists targeting operational technology (OT) and industrial control systems (ICS) without fully understanding them, often blurring the lines between propaganda and genuine cyber operations. TwoNet initially focused on distributed denial-of-service (DDoS) attacks before attempting more sophisticated intrusions targeting SCADA systems in countries deemed hostile to Russia. Their claims mirror those of other pro-Russian groups, like CyberTroops and OverFlame, who have boasted of compromising control interfaces at critical infrastructure facilities. While TwoNet’s attack was harmless, real-world hacktivist operations have had serious consequences, such as the Cyber Army of Russia Reborn (CARR) causing water tank overflows in Texas.