Loading threat actor…
CyberAv3ngers is an Iranian state-linked threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). Active since at least 2020, it specializes in disruptive operations against operational technology, industrial control systems, and civilian critical infrastructure. Its aliases include Cyber Avengers, CyberAveng3rs, Bauxite, UNC5691, and Shahid Kaveh Group. Microsoft tracks CyberAv3ngers and its associated group Soldiers of Solomon together as Storm-0784. The group targets Israeli organizations and Israeli-manufactured industrial equipment deployed internationally, including in the United States and United Kingdom. Water and wastewater utilities are prominent victims, alongside energy infrastructure and private-sector industrial systems. Its operations combine interference with industrial processes and anti-Israeli messaging, including defacement of human-machine interfaces and public promotion of attack claims. CyberAv3ngers locates internet-exposed programmable logic controllers and human-machine interfaces through scanning and exploits default, weak, or absent authentication. Between November 2023 and January 2024, its Unitronics campaigns compromised at least 75 controllers, including 34 in the U.S. water and wastewater sector. The November 2023 compromise at the Municipal Water Authority of Aliquippa disrupted a pressure-regulation pump and defaced a controller interface, although the utility reported no impact on drinking-water safety. Documented activity includes changing remote-access credentials and device configurations and modifying PLC ladder logic, potentially disrupting pumps, valves, and other physical processes. CyberAv3ngers is also linked to IOCONTROL, known as OrpaCrab, a modular malware family targeting Linux-based operational-technology and Internet of Things devices, including routers, controllers, human-machine interfaces, and firewalls. Its operational emphasis is on infrastructure disruption and geopolitical coercion rather than financially motivated extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
43 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
CVE-2021-22681 is a critical authentication bypass in Rockwell Automation's Logix controller ecosystem caused by an insufficiently protected cryptographic key used to verify communications between Studio 5000 Logix Designer and Logix PLCs. Anyone who can obtain or intercept that key can pose as legitimate engineering software and gain direct, unauthenticated access to affected controllers.
On Monday, the U.S. Cybersecurity and Infrastructure Security Agency added the Unitronics bug to its Known Exploited Vulnerabilities catalog, assigning it CVE-2023-6448. The advisory warned that “Unitronics Vision Series PLCs and HMIs [Human Machine Interfaces] use default administrative passwords.” “An unauthenticated attacker with network access to a PLC or HMI can take administrative control of the system,” the agency said.
On April 8, the CyberAv3ngers released a technical video claiming successful unauthorized access to a series of internet-exposed Barix endpoints. A forensic reconstruction of the video's logs reveals an exploitation path centered on CVE-2024-41700, a high-severity information exposure vulnerability affecting Barix SIP client firmware.
45 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Iran-sponsored group operating under IRGC-CEC and associated with attacks on critical infrastructure. The article describes attacks against U.S. water, energy, and government facilities whose TTPs are consistent with CyberAv3ngers activity, rather than definitively attributing these attacks to the group. The attacks targeted internet-connected operational technology and caused operational disruptions and financial losses.
Mentioned as a historical precedent for attacks on internet-exposed operational technology. The group compromised Unitronics controllers at a U.S. water utility in 2023 using default credentials. The content does not link CyberAv3ngers to the supermarket refrigeration attacks.
An Iranian IRGC-linked threat group scrutinized in connection with U.S. water-sector intrusions. It has targeted internet-exposed industrial controllers, initially abusing default passwords on Israeli-made water-utility controllers, later deploying IOCONTROL malware, and more recently exploiting an authentication-bypass flaw in Rockwell Automation Logix PLCs.
An Iranian-linked group presented as connected to APT Iran and associated with infrastructure threats and purported industrial-control-system compromise activity.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.