Cyber Av3ngers

Also known as: Cyber Av3ngers, CyberAv3ngers, Shahid Kaveh Group, Soldiers of Soloman

The CyberAv3ngers are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The CyberAv3ngers have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel. CISA AA23-335A IRGC-Affiliated December 2023

In 2023, the CyberAv3ngers engaged in a global targeting and hacking of the Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface. CISA AA23-335A IRGC-Affiliated December 2023

🌍 Country Iran
🧭 ATT&CK G1027

Associated Operations

2023-11 2023-12 Pennsylvania water authority hit with cyberattack allegedly tied to pro-Iran group Two-day water outage in remote Irish region caused by pro-Iran hackers https://therecord.media/water-authority-pennsylvania-cyberattack-pro-iran-group https://therecord.media/water-outage-in-ireland-county-mayo

Introduction

The CyberAv3ngers are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The CyberAv3ngers have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel. CISA AA23-335A IRGC-Affiliated December 2023 In 2023, the CyberAv3ngers engaged in a global targeting and hacking of the Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface. CISA AA23-335A IRGC-Affiliated December 2023

Activities and Tactics

Country of Origin: 🇮🇷 Iran

Notable Campaigns

  • Unitronics Defacement Campaign (C0031): The Unitronics Defacement Campaign was a collection of intrusions across multiple sectors by the CyberAv3ngers, where threat actors engaged in a seemingly opportunistic and global targeting and defacement of Unitronics Vision Series Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). The sectors that these PLCs can be commonly found in are water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement o

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • CyberGate
  • Cyber Eye RAT

Attribution and Evidence

Country of Origin: Iran Additional attribution information pending cataloguing.

References

[1] mitre-attack [3] CISA AA23-335A IRGC-Affiliated December 2023 DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.