Loading story…
Claroty’s Team82 reported that IOCONTROL, a custom malware attributed to Iran-affiliated actors and linked to CyberAv3ngers, was used against civilian critical infrastructure in Israel and the United States. The malware was recovered from a Gasboy fuel control system payment terminal and is designed to compromise a broad range of Linux-based IoT and OT assets, including Orpak and Gasboy fuel management systems, routers, PLCs, HMIs, firewalls, and IP cameras. Researchers said the activity aligns with prior CyberAv3ngers operations against Unitronics devices at water facilities and with the group’s claims of compromising hundreds of gas stations.
The malware was described as a modular cyberweapon built for stealth and persistence. Team82 said IOCONTROL uses modified UPX-style packing, an AES-256-CBC encrypted configuration derived from a hardcoded GUID, DNS over HTTPS via Cloudflare for command-and-control resolution, and secure MQTT over port 8883 for communications. It establishes persistence through an rc3.d boot script, sends a JSON-based "hello" beacon to identify infected devices, and supports arbitrary command execution, self-deletion, executable verification, and port scanning. Researchers also noted that, as of December 10, 2024, the analyzed IOCONTROL sample reportedly evaded detection by all 66 antivirus engines on VirusTotal.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
As of December 10, 2024, BleepingComputer reported that none of 66 antivirus engines on VirusTotal detected the UPX-packed IOCONTROL binary. This indicated the sample was still evading mainstream AV detection at that time.
Researchers reported that IOCONTROL activity resumed in mid-2024, with Claroty describing a relaunch in July-August 2024. The renewed campaign continued targeting IoT and OT devices associated with critical infrastructure.
Claroty said the IOCONTROL campaign against Orpak devices spanned from mid-October 2023 to late January 2024. The activity affected fuel management environments in Israel and the United States.
The IOCONTROL command-and-control infrastructure included the domain tylarion867mino.com, which Claroty said was registered on November 23, 2023. The malware later used a hostname under this domain for C2 communications.
Claroty reported that an IOCONTROL campaign targeting Israel-made Orpak Systems and U.S.-made Gasboy fuel management systems began in mid-October 2023 in Israel and the United States. One attack wave compromised several hundred devices tied to these vendors.
Claroty Team82 published analysis of IOCONTROL, describing it as a custom IoT/OT malware used by Iran-affiliated attackers and linking the activity to CyberAv3ngers. The report said the malware targeted Israel- and U.S.-based critical infrastructure devices including routers, PLCs, HMIs, firewalls, IP cameras, and fuel management systems.
CyberAv3ngers claimed on Telegram that it had attacked 200 gas stations in Israel and the United States targeting Orpak systems, and shared screenshots and leaked target data. Claroty said these claims aligned with its findings on the IOCONTROL activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that malware targeting operational technology is broader than rare, bespoke ICS implants alone. Mandiant detailed **COSMICENERGY**, an OT-focused malware framework with similarities to **INDUSTROYER**, **TRITON**, and **INCONTROLLER**, built around insecure industrial protocols such as `IEC-104` and packaged with common Python tooling. Separate Mandiant reporting on **INCONTROLLER** described modular tools including **TAGRUN** for OPC UA reconnaissance, **CODECALL** for Modbus and Schneider Electric PLC interaction, and **OMSHELL** for gaining shell access to Omron PLC environments, enabling actions ranging from tag manipulation and credential attacks to file transfer, traffic capture, and program-memory wiping. At the same time, Forescout found that generic malware families are increasingly reaching into OT environments through exposed devices and weak credentials rather than highly tailored tradecraft. In a VirusTotal hunt, researchers identified botnet-linked samples tied to **Aisuru**, **Kaiten**, and **Gafgyt** that attempted logins against PLCs and other OT products using default credentials, with some samples trying to wipe directories such as `/mnt/modbus_rtu`; affected technologies included devices from Modicon, Siemens, Emerson, Avocent, and Sierra Wireless. Dragos also documented trojanized "password recovery" tools for industrial assets, including one for Automation Direct DirectLogic 06 PLCs that exploited **CVE-2022-2003** to retrieve passwords while infecting engineering workstations with **Sality**, underscoring that OT operators face both purpose-built ICS malware and commodity malware abusing industrial access paths.
Aug 15, 2026
**Iran-linked CyberAv3ngers** activity targeting **Unitronics Vision PLCs** in internet-exposed operational technology environments is the clearest common security event in the provided material. The reporting describes campaigns against critical infrastructure, especially **water and wastewater systems**, with attackers exploiting **default credentials**, weak segmentation, and exposed OT assets to gain access and potentially disrupt operations or manipulate industrial processes. The activity is framed as part of broader Iranian state-linked cyber operations aligned with regional geopolitical tensions, with emphasis on U.S. and allied infrastructure at risk of operational and possible physical consequences. One reference provides technical and threat-context detail on the **CyberAv3ngers/IRGC-linked** targeting of Unitronics devices, while another discusses the wider cyber dimension of conflict involving Iranian groups pre-positioning in U.S. networks and threatening sectors such as water, hospitals, finance, and power. That second piece is relevant as contextual support for the same Iran-linked critical infrastructure threat environment, though it is broader and less specific to the **Unitronics PLC** intrusion pattern. The remaining references cover unrelated topics including malicious npm packages, GitHub repository compromise, Ivanti EPMM exploitation, a Ukraine-focused backdoor campaign, AI security commentary, and vendor detection updates, and do not describe the same incident or disclosure.
Jun 29, 2026
Suspected Iranian hackers breached internet-exposed automatic tank gauge (ATG) systems at gas stations in several U.S. states, reportedly targeting **Veeder-Root** `TLS-350` and `TLS-450 Plus` consoles that lacked password protection rather than exploiting a newly disclosed flaw. Advisories said incidents affected sites in Tennessee, including one convenience store chain with 15 tanks impacted, and in some cases attackers deleted fuel tank and sensor data or altered system settings. Officials said no physical damage was reported, but security experts warned that compromised ATGs could enable fuel overfills, disable safety alarms, and cause environmental or equipment damage. The intrusions come amid a broader surge in attacks on operational technology across industrial sectors. NCC Group said industrial organizations suffered **2,073 ransomware attacks** in the 12 months to March 2026, accounting for **30% of all ransomware activity**, with manufacturers of capital goods, machinery, construction, and engineering among the hardest hit. The report said many organizations still prioritize IT defenses over OT security even as governments and regulators expand resilience requirements, while international authorities have issued procurement guidance to push stronger security controls into OT products and supply chains.
Aug 7, 2026