Executive Summary

An actor published material claiming to have used TRK25 ADVANCED ICS to access industrial control systems in Argentina. According to iQBlack’s collection, TRK25 ADVANCED ICS is a tool attributed to Infrastructure Destruction Squad, based on information collected from official monitored channels of the actor.

The communication mentions two cases: interfaces associated with industrial compressor systems linked to UniControl Ingeniería en Automatización, and electrical, automation, water plant and municipal lighting systems attributed to the Municipality of Colón, in Entre Ríos Province.

The videos accompanying the publication show HMI/SCADA interfaces with operational data, graphical panels, alarms, pressure, temperature, current and speed parameters, and operating states.

Key Judgments

• TRK25 ADVANCED ICS is a tool attributed to Infrastructure Destruction Squad, according to iQBlack’s own collection and monitored actor-controlled sources.
• The appearance of TRK25 ADVANCED ICS in a publication about ICS/HMI interfaces in Argentina introduces a relevant instrumental link between the observed event and the Infrastructure Destruction Squad ecosystem.
• The first case is linked to industrial compressor systems and the exposure of variables such as pressure, temperature, current, speed and operating capacity.
• The second case is linked to municipal systems in Colón, Entre Ríos, including a water plant, automation, pumps, compressors, alarms and operating indicators.
• The association of Infrastructure Destruction Squad with BLACKNET-00, observed in internal sources and also reported by external OSINT, reinforces the actor’s hybrid profile across ICS/OT tools, ransomware, technical propaganda and criminal monetization.

What Happened

The actor released two pieces of information accompanied by screen-recorded videos. In the first case, it claims that TRK25 ADVANCED ICS was used to access industrial control systems belonging to UniControl Ingeniería en Automatización in Argentina. According to the message, the access would have reached main control interfaces for compressors and critical industrial equipment used in refrigeration, air conditioning and industrial processes.

The publication mentions operational data such as suction pressure, discharge pressure, oil pressure, pump pressure, filter pressure, differential pressure, operating capacity, electrical current and rotational speed. It also mentions suction, discharge, oil and crankcase temperatures.

The associated video shows an interface bearing the UniControl brand, a compressor diagram, start/stop states, pressure values, temperatures, electrical current and speed. Sections showing historical logs of analog variables are also visible.

In the second case, the actor claims to have compromised electrical and automation systems associated with the Municipality of Colón, in Entre Ríos. According to the message, the access would include control units at the water plant, municipal lighting control systems, electrical automation and municipal services.

The corresponding video shows screens with diagrams of a water plant, compressors, pumps, tanks, alarms, manual or automatic modes, and operating indicators. A historical alarm log is also visible, with events associated with compressors and start failures.

Operational Assessment

The mention of TRK25 ADVANCED ICS is the central indicator in this case. For iQBlack, the tool is attributed to Infrastructure Destruction Squad based on publications observed in official monitored channels of the actor. External OSINT sources also associate TRK25 Advanced SCADA with Infrastructure Destruction Squad and describe it as a tool aimed at scanning industrial ranges, extracting banners and logging SCADA vulnerabilities. KELA also describes the actor as a Telegram-based entity combining political hacktivism with profit-driven criminal activity, including ICS/SCADA tools and the BLACKNET-00 ransomware builder.

This attribution does not automatically imply that Infrastructure Destruction Squad directly executed the observed accesses. However, it does allow the event to be registered as a possible instance of use, demonstration, promotion or operational circulation of a tool attributed to that actor. In intelligence terms, TRK25 ADVANCED ICS functions as a correlation pivot between the material observed in Argentina, the offensive ICS/OT ecosystem and the public activity of Infrastructure Destruction Squad.

In both cases, the visual material carries more weight than a simple textual statement. The observed screens are compatible with industrial monitoring and automation environments. However, viewing an interface does not automatically allow the conclusion that the actor can modify parameters, execute critical commands, alter processes or maintain persistent access.

The first case is relevant because of the type of variables exposed. Pressures, temperatures, current and compressor speed may constitute sensitive operational data. In the hands of a hostile actor, this type of information may help understand load states, operating cycles, safety conditions, usage profiles and possible pressure points within an industrial process.

The second case raises sensitivity because it involves municipal services. Water, pumping, lighting and building or public-service automation systems may have a direct impact on operational continuity, public perception and institutional reputation. Even if the access were only visual, the publication of interfaces linked to a water plant or municipal services may generate public concern and pressure on authorities and operators.

It should also not be assumed that the targets suffered recent direct intrusions. In OT/ICS environments, exposure may originate from poorly protected remote access, accessible HMI interfaces, weak credentials, integrators, providers, maintenance networks, exposed services or material captured from previous sessions.

Intelligence Significance

The case is relevant because it shows a new signal of OT/ICS exposure in Argentina while also introducing a tool attributed to Infrastructure Destruction Squad as a correlation indicator.

The declared activity aligns with a trend observed among actors that use visual access to industrial interfaces as a demonstration mechanism. In these types of operations, the impact does not depend solely on process manipulation. The publication of screens, variables, alarms and diagrams may be enough to generate a perception of risk, institutional pressure, questions about security and reputational value for the actor.

The convergence of industrial automation and municipal services broadens the interest of the case. An industrial compressor environment may expose production or refrigeration processes. A municipal environment may be associated with public services, water, pumps, lighting and local operational continuity. In both cases, the exposure of control interfaces should be treated as an information security and operational security risk.

The attribution of TRK25 ADVANCED ICS to Infrastructure Destruction Squad adds an additional layer. The event should not be seen only as an isolated publication about Argentine HMIs, but as a possible demonstration or circulation of a tool associated with an actor that promotes offensive capabilities against ICS/OT environments and has also been linked to BLACKNET-00. That combination reinforces a hybrid profile in which technical propaganda, industrial tools, ransomware and monetization may coexist within the same ecosystem.

For CTI, OT, infrastructure and institutional response teams, priorities should focus on validating whether the interfaces remain exposed, reviewing remote access, auditing credentials, confirming authentication logs, identifying anomalous sessions, verifying IT/OT segmentation, reviewing provider accounts and ensuring that HMI/SCADA interfaces are not accessible from unauthorized networks.

It is also important to separate the technical analysis from the actor’s narrative. The material may be useful as a preliminary indicator of exposure, but it does not represent confirmation of full compromise, destructive control or immediate physical risk without additional telemetry.

Analytical Closing

The publication associated with TRK25 ADVANCED ICS claims access to industrial control interfaces in Argentina, with references to UniControl Ingeniería en Automatización and municipal systems in Colón, Entre Ríos.

According to iQBlack’s collection, TRK25 ADVANCED ICS is attributed to Infrastructure Destruction Squad based on information collected from official monitored channels of the actor. That attribution makes the tool a relevant indicator for correlating the event with the offensive ICS/OT ecosystem linked to Infrastructure Destruction Squad, an actor also associated with the BLACKNET-00 ransomware.

iQBlack assesses the immediate intelligence value in the combination of visual evidence, the sensitivity of the mentioned environments, the exposure of operational variables and the appearance of a tool attributed to Infrastructure Destruction Squad in material related to Argentine targets.