CYBERAV3NGERS

CyberAv3ngers is a state-directed cyber unit of Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) that operates publicly as a self-presented "hacktivist" collective, active since at least 2020 and tracked under the MITRE ATT&CK designation G1027. It is tracked in industry reporting under a wide alias set — Soldiers of Solomon, Shahid Kaveh Group, and Hydro Kitten/UNC5691 (Mandiant), Storm-0784 (Microsoft), and Bauxite (Dragos) — reflecting independent convergence across multiple vendors and government agencies on the same underlying actor. Unlike most nation-state-linked groups this profile series covers, CyberAv3ngers is defined not by espionage or financial theft but by direct sabotage-oriented targeting of operational technology (OT) and industrial control systems (ICS): programmable logic controllers (PLCs), human-machine interfaces (HMIs), and the physical processes they govern.

The group matters acutely right now because its capability and reach have escalated sharply and repeatedly since its public debut. What began in November 2023 as opportunistic exploitation of a single default administrative password ("1111") on internet-exposed Unitronics Vision Series PLCs — compromising a booster station at the Municipal Water Authority of Aliquippa, Pennsylvania, among at least 75 devices worldwide — had by April 2026 escalated into a six-agency U.S. joint advisory (AA26-097A) confirming active exploitation of an unpatched, four-year-old Rockwell Automation authentication-bypass vulnerability (CVE-2021-22681) across water, energy, and government infrastructure nationally, plus expansion to Schneider Electric and Siemens devices via malicious project files engineered to override safety-critical logic. That trajectory culminated, as of this compile, in a coordinated July 2026 strike that knocked out or degraded operator control at 30-plus Minnesota water utilities in a single 24-hour window, with confirmed intrusions spanning at least seven U.S. states.

CyberAv3ngers sits at the center of a specific geopolitical function: its hacktivist framing supplies Iran a layer of public deniability for actions against U.S. and Israeli critical infrastructure amid sustained regional tension, while U.S. Treasury, CISA, and multiple private-sector vendors have explicitly and publicly pierced that framing. OFAC sanctioned six named IRGC-CEC officials — including Hamid Reza Lashgarian, head of the IRGC-CEC and a commander in the IRGC-Qods Force — in February 2024, alongside a $10 million State Department bounty, formally establishing state attribution well before the group's most consequential 2026 activity.

The critical operational context defenders should hold in mind: CyberAv3ngers' core enabling condition has never been sophisticated malware. It is the routine, often unnecessary practice of exposing PLC and HMI management interfaces directly to the public internet — disproportionately common among small, rural, and municipal water utilities operating with minimal dedicated OT security investment. The group has now demonstrated, repeatedly and at increasing scale despite sanctions, an indictment-adjacent bounty program, and multiple public advisories, that this structural weakness across the U.S. water sector remains exploitable on demand.

CyberAv3ngers' intrusion lifecycle begins almost entirely with internet-facing reconnaissance rather than social engineering or supply-chain compromise: Shodan- and Censys-style sweeps for OT/ICS devices exposed directly to the public internet, keyed to known default service ports — TCP 20256 for Unitronics Vision Series PLCs, TCP 44818 for Rockwell EtherNet/IP-enabled controllers (T1595.002). Because so many small and municipal utilities operate these devices without any VPN, firewall segmentation, or network isolation between the management interface and the open internet (T1133), a successful scan alone frequently yields direct administrative reach to a live industrial process.

Initial access itself has evolved but has consistently avoided the need for sophisticated exploitation until relatively recently. The 2023 Unitronics campaign required nothing more than the PLC/HMI's unmodified factory-default administrative password, "1111" (T1078.001) — no malware, no exploit, and no credential theft was necessary. The 2026 Rockwell campaign marks a genuine sophistication increase: it weaponizes CVE-2021-22681, a critical authentication-bypass flaw in the cryptographic key used to verify communications between Rockwell's engineering software and Logix-family controllers, for which Rockwell has never issued a firmware patch (T1190). Once inside, the group has needed almost no lateral movement in the traditional IT sense, because the compromised device — a PLC or HMI — is itself the target and the endpoint of impact.

Where impact requires more than administrative access to native device functions, the group deploys IOCONTROL, its custom, modular Linux malware platform for OT/IoT devices. IOCONTROL installs a persistence mechanism via an rc.d boot script (T1037.004) and communicates with its operators over MQTT/TLS on port 8883 — a standard IoT protocol chosen specifically to blend command-and-control traffic with legitimate device telemetry — while resolving C2 domains via DNS-over-HTTPS to defeat DNS-based blocking (T1071, T1071.004). Its configuration is AES-256-CBC encrypted and its binary UPX-packed (T1027), reflecting a maintained, professionally engineered development effort well beyond what the group's 2023 campaign required. The final impact phase is where CyberAv3ngers most clearly diverges from typical eCrime or espionage actors: rather than exfiltrating data, the group erases or overwrites original PLC ladder logic with non-functional custom logic, changes device IP addresses and passwords specifically to lock legitimate operators out (as observed at scale in the July 2026 Minnesota campaign), and — per the 2026 Schneider/Siemens expansion — uploads malicious project files intended to override safety-critical control logic, a category of impact that moves beyond availability disruption into genuine physical-safety risk.

CyberAv3ngers occupies an unusually clear-cut position in the threat landscape: a state-directed actor whose sponsorship is not merely assessed but formally established through sanctions naming specific serving officers, operating with a public messaging apparatus that is transparently disposable and separable from its technical capability. That separation is itself analytically significant — takedowns of individual Telegram personas (the April 2024 disruption, the "APT IRAN" channel deletion) have consistently failed to reduce the group's underlying technical operational tempo, evidenced by the escalation straight through 2025 and into the 2026 Rockwell/Schneider/Siemens campaign. Any defensive or policy response premised on disrupting the persona layer alone should be understood as addressing symptom, not cause.

The single most consequential capability shift in this profile is the group's move, confirmed in the April 2026 AA26-097A advisory, from PLCs and ladder logic that merely stop functioning (denial of control, denial of view) to malicious project files on Schneider Electric and Siemens devices specifically engineered to override safety-critical logic and present operators with falsified process readings. That is a different risk category than an offline water pump: it describes the technical precondition for a scenario in which a facility's control system reports normal, safe operating parameters while the underlying physical process has been deliberately pushed outside safe bounds. No public reporting reviewed for this compile confirms such an outcome has yet occurred, and that gap should be stated plainly rather than implied — but the capability to attempt it is now documented, which was not true as recently as late 2023.

Competing hypotheses on intent persist and should inform, rather than be resolved by, this assessment: the group's activity is consistent with pure disruption/harassment (locking operators out, defacing HMI displays, generating propaganda material), with intelligence pre-positioning (maintaining latent access to U.S. critical infrastructure for use in a future crisis), or with both simultaneously as complementary lines of effort within the same IRGC-CEC unit. The July 2026 Minnesota campaign's tight, coordinated 24-hour timing across 30+ independently operated utilities argues for centralized, scripted state tasking rather than freelance or loosely coordinated hacktivist opportunism — a datapoint that should raise, not lower, confidence in the pre-positioning hypothesis. Confidence in the group's near-term trajectory would increase with formal government attribution of the Minnesota campaign (currently a vendor assessment, not an official one) and would be most significantly revised upward in severity by any confirmed instance of the safety-override capability actually being triggered against a live process.

Beyond CTID, no OT/ICS-specific Atomic Red Team tests or Sigma detection rules mapped directly to CyberAv3ngers' PLC-manipulation techniques (ATT&CK for ICS T0836, T0831, T0856, T0809, T0813) were identified as published during this compile — these techniques describe device-specific control-logic manipulation that general-purpose Windows/Linux-oriented detection-content repositories do not typically cover. The most directly applicable published purple-team resources are the detection and indicator guidance embedded in the CISA/FBI joint advisories themselves (AA23-335A, AA26-097A) and Claroty Team82's IOCONTROL technical report, both of which include protocol- and behavior-level detection guidance referenced in Sections 07 and 11 above. Organizations building a purple-team program against this actor should treat those advisories, plus Dragos's and Claroty's OT-specific threat-hunting guidance, as the primary available emulation and detection references rather than relying on general enterprise-IT detection-content libraries, which currently have no CyberAv3ngers-specific coverage.