CyberAv3ngers
The CyberAv3ngers are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The CyberAv3ngers have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.[1]
In 2023, the CyberAv3ngers engaged in a global targeting and hacking of the Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface.[1]
Associated Group Descriptions
| Name | Description |
|---|---|
| Soldiers of Soloman |
CyberAv3ngers reportedly has connections to the IRGC-linked group Soldiers of Solomon.[1] |
Campaigns
| ID | Name | First Seen | Last Seen | References | Techniques |
|---|---|---|---|---|---|
| C0031 | Unitronics Defacement Campaign | November 2023 [1] | November 2023 [2] | Denial of Service, Insecure Credentials: Default Credentials, Internet Accessible Device, Loss of Availability, Loss of Productivity and Revenue, Loss of View |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| ICS | T1695 | Block Communications |
During the 2026 Iranian Water Campaign, CyberAv3ngers locked out operators by changing the PLC’s IP address.[3] |
|
| ICS | T0892 | Change Credential |
During the 2026 Iranian Water Campaign, CyberAv3ngers locked out operators by changing the PLCs passwords and IP addresses.[3] |
|
| ICS | T0885 | Commonly Used Port |
During the 2026 Iranian Water Campaign, CyberAv3ngers were observed using secure shell ports TCP/22 and common industrial ports (TCP/44818, TCP&UDP/2222, TCP/102, and TCP/502). [4] |
|
| ICS | T0879 | Damage to Property |
During the 2026 Iranian Water Campaign, CyberAv3ngers disrupted water operations that have included loss of water pressure and flooding.[3] |
|
| ICS | T0814 | Denial of Service |
During the Unitronics Defacement Campaign, the CyberAv3ngers defaced controllers’ Human-Machine Interface (HMI), which prevented multiple entities from being able to operate their devices normally.[1][5][6][7] Additionally, the CyberAv3ngers caused a communications failure in a remote pumping station.[8] |
|
| ICS | T0871 | Execution through API |
During the 2026 Iranian Water Campaign, CyberAv3ngers leveraged existing PLC management protocols through the manufacturer’s engineering tools. These include EtherNet/IP CIP, S7Comm, and UMAS.[4] |
|
| ICS | T1694 | .001 | Insecure Credentials: Default Credentials |
During the 2026 Iranian Water Campaign, CyberAv3ngers accessed internet-accessible equipment using default credentials.[3][9] During the Unitronics Defacement Campaign, the CyberAv3ngers discovered and exploited default credentials found on many Unitronics Programmable Logic Controller (PLC) Human-Machine Interface (HMI). For many of these devices, the default password was set to ‘1111’.[1][5] |
| ICS | T0883 | Internet Accessible Device |
During the 2026 Iranian Water Campaign, CyberAv3ngers accessed internet accessible PLCs that were exposed through cellular gateways across multiple vendors including Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens.[4] During the Unitronics Defacement Campaign, the CyberAv3ngers exploited devices connected to the public internet, such as internet connected Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI) and networking equipment such as cellular modems found in OT environments.[1][2] |
|
| ICS | T0826 | Loss of Availability |
During the 2026 Iranian Water Campaign, CyberAv3ngers degraded operations across at least seven states that resulted in reported incidents, pressure loss and flooding.[3] During the Unitronics Defacement Campaign, the CyberAv3ngers caused multiple businesses to halt operations due to the unavailability of the Programmable Logic Controller (PLC) and Human-Machine Interface (HMI). These victims covered multiple sectors.[6] |
|
| ICS | T0827 | Loss of Control |
During the 2026 Iranian Water Campaign, CyberAv3ngers manipulated process logic, HMI, and SCADA displays. In addition to this, adversaries locked victims out by changing the PLCs management passwords.[4] |
|
| ICS | T0828 | Loss of Productivity and Revenue |
During the Unitronics Defacement Campaign, the CyberAv3ngers caused multiple businesses to halt operations in their industrial environments, impacting their typical business operations. These victims covered multiple sectors.[6] |
|
| ICS | T0880 | Loss of Safety |
During the 2026 Iranian Water Campaign, CyberAv3ngers manipulated critical shutdown and alarm logic, which would allow the system to enter unsafe process states without proper notification or protections.[4] |
|
| ICS | T0829 | Loss of View |
During the 2026 Iranian Water Campaign, CyberAv3ngers manipulated process logic, HMI, and SCADA displays, which may disrupt operators view of the system.[4] During the Unitronics Defacement Campaign, the CyberAv3ngers replaced the existing graphic on the Programmable Logic Controller (PLC) Human-Machine Interface (HMI) with their own, thereby preventing PLC owners and operators from viewing PLC information on the HMI.[1][6] |
|
| ICS | T0838 | Modify Alarm Settings |
During the 2026 Iranian Water Campaign, CyberAv3ngers manipulated critical shutdown and alarm logic.[4] |
|
| ICS | T0889 | Modify Program |
During the 2026 Iranian Water Campaign, CyberAv3ngers used manufacturers’ commercial PLC programming software to modify their victim’s running PLC program logic. These include Rockwell Automation’s Studio Logix 5000 Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal.[4] |
|
| ICS | T0843 | Program Download |
During the 2026 Iranian Water Campaign, CyberAv3ngers used the manufacturers’ commercial PLC programming software to push new configurations to victim hardware. These include Rockwell Automation’s Studio Logix 5000 Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal. In these changes, adversaries deleted program logic, removed Add-On Instructions (AOIs) and manipulated alarm logic and HMI screens.[4] |
|
| ICS | T0845 | Program Upload |
During the 2026 Iranian Water Campaign, CyberAv3ngers used the program upload feature to exfiltrate project files from victim PLCs. [4] |
|
| ICS | T0886 | Remote Services |
During the 2026 Iranian Water Campaign, one victim reported actors leveraged Dropbear Secure Shell (SSH) software to enable remote access over port 22.[4] |
|
| ICS | T1692 | .001 | Unauthorized Message: Command Message |
During the 2026 Iranian Water Campaign, CyberAv3ngers used the manufacturers’ commercial PLC programming and maintenance software to send unauthorized command messages to multiple victim controllers. These include Rockwell Automation’s Studio Logix 5000 Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal .[4] |
References
- DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.
- Lisa Zahner. (2023, December 15). Hackers in Iran attack computer at Vero Utilities. Retrieved March 25, 2024.
- Research Special Operations. (2026, July 28). Coordinated "cyberattack" on U.S. water utilities: What you need to know. Retrieved September 26, 2026.
- Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.
- DHS/CISA. (2023, November 28). Exploitation of Unitronics PLCs used in Water and Wastewater Systems. Retrieved March 25, 2024.
- Jamie Tarabay and Katrina Manson. (2023, December 22). Iranian-Linked Hacks Expose Failure to Safeguard US Water System. Retrieved March 25, 2024.
- Frank Bajak and Marc Levy. (2023, December 2). Breaches by Iran-affiliated hackers spanned multiple U.S. states, federal agencies say. Retrieved March 25, 2024.
- WPXI. (2023, November 27). Officials investigating cyberattack on Municipal Water Authority of Aliquippa. Retrieved March 25, 2024.
- Connor Hazen. (2026, July 31). When 30 Water Utilities Get Hit in 48 Hours, the Lesson Isn’t “Better Malware” — It’s “No Front Door” . Retrieved September 26, 2026.
