Loading story…
The U.S. State Department's Rewards for Justice program offered up to $10 million for information identifying or locating Amir Yaryab, whom U.S. officials describe as a senior official leading the Islamic Revolutionary Guard Corps Cyber-Electronic Command's Cyber Operations Command. The U.S. alleges that Yaryab directs cyber units targeting critical infrastructure across the United States, Europe, and the Middle East, including the defense, news, shipping, water, and wastewater sectors.
The announcement links Yaryab and the IRGC-CEC to CyberAv3ngers and Dadeh Afzar Arman. CyberAv3ngers reportedly compromised at least 75 internet-exposed Unitronics Vision Series PLCs between November 2023 and January 2024, including 34 in U.S. water and wastewater organizations, by abusing default or missing passwords. The intrusions reportedly altered PLC ladder logic, credentials, and configurations and defaced HMIs, risking disruption to industrial processes; operators should eliminate direct internet exposure of OT devices, enforce strong authentication, patch affected systems, and secure remote access through VPNs and firewalls.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
CyberAv3ngers reportedly conducted attack waves against internet-exposed Unitronics Vision Series PLCs, exploiting default or absent passwords. The activity ran from November 2023 through January 2024 and included at least 75 compromised PLCs, 34 of them in the U.S. water and wastewater sector.
A joint advisory by CISA, the FBI, NSA, EPA, and international partners reported that IRGC-connected actors began compromising Israeli-made Unitronics Vision Series PLCs in late 2023. Reported intrusions included ladder-logic changes, configuration and credential tampering, and HMI defacements.
The U.S. State Department's Rewards for Justice program offered up to $10 million for information identifying or locating Amir Yaryab, whom U.S. officials allege leads IRGC Cyber-Electronic Command cyber operations. Authorities linked him to IRGC-affiliated groups including CyberAv3ngers and Dadeh Afzar Arman and alleged their targeting of critical-infrastructure sectors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourcerewardsforjustice.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. State Department offered up to **$10 million** for information on six Iranian government hackers allegedly linked to the Islamic Revolutionary Guard Corps Cyber-Electronic Command and the **CyberAv3ngers** campaign targeting **Unitronics Vision Series PLCs** used in critical infrastructure, including U.S. water utilities. U.S. officials said the group exploited internet-exposed devices with default credentials and, in late 2023, defaced compromised systems with anti-Israel messages while claiming the attacks were retaliation for Israel’s actions in Gaza. One of the most visible incidents hit the Municipal Water Authority of Aliquippa, Pennsylvania, which temporarily shifted to manual operations after an intrusion reached a pressure-regulating pump, though officials said water treatment and safe drinking water were not affected. In response, **CISA** began directly contacting water utilities with exposed Unitronics devices and urged operators to change default passwords, while the FBI and EPA said only a small number of utilities were known to be impacted but warned that exposed PLCs could provide a foothold for deeper network access and potential physical damage.
Jun 29, 2026
**Iran-linked CyberAv3ngers** activity targeting **Unitronics Vision PLCs** in internet-exposed operational technology environments is the clearest common security event in the provided material. The reporting describes campaigns against critical infrastructure, especially **water and wastewater systems**, with attackers exploiting **default credentials**, weak segmentation, and exposed OT assets to gain access and potentially disrupt operations or manipulate industrial processes. The activity is framed as part of broader Iranian state-linked cyber operations aligned with regional geopolitical tensions, with emphasis on U.S. and allied infrastructure at risk of operational and possible physical consequences. One reference provides technical and threat-context detail on the **CyberAv3ngers/IRGC-linked** targeting of Unitronics devices, while another discusses the wider cyber dimension of conflict involving Iranian groups pre-positioning in U.S. networks and threatening sectors such as water, hospitals, finance, and power. That second piece is relevant as contextual support for the same Iran-linked critical infrastructure threat environment, though it is broader and less specific to the **Unitronics PLC** intrusion pattern. The remaining references cover unrelated topics including malicious npm packages, GitHub repository compromise, Ivanti EPMM exploitation, a Ukraine-focused backdoor campaign, AI security commentary, and vendor detection updates, and do not describe the same incident or disclosure.
Jun 29, 2026
A joint U.S. government advisory said Iranian-affiliated cyber actors are actively exploiting internet-facing operational technology devices across multiple U.S. critical infrastructure sectors, with a particular focus on **Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs)**. The activity has affected organizations in Government Services and Facilities, Water and Wastewater Systems, and Energy, where attackers maliciously interacted with project files and manipulated data displayed on **HMI** and **SCADA** systems, causing operational disruption and financial losses for some victims. The campaign has been observed since at least March 2026 and shows similarities to prior **CyberAv3ngers** activity linked to the IRGC Cyber Electronic Command. According to the advisory, the actors used overseas IP infrastructure, **Rockwell Studio 5000 Logix Designer**, OT-related ports including `44818`, `2222`, `102`, `22`, and `502`, and **Dropbear SSH** for remote access. U.S. authorities urged operators to remove PLCs from direct internet exposure, harden remote access, enable logging, place controllers in run mode where appropriate, and review published indicators of compromise and ATT&CK-mapped TTPs alongside Rockwell Automation security guidance.
Aug 12, 2026