IranAttributedIRGC-affiliatedDestructiveActive 2020 – 2026CyberAv3ngers
Also known asHydro Kitten · Storm-0784 · Bauxite · CL-STA-1128 · Cyber Avengers
Summary
IRGC-affiliated persona: the joint advisory AA23-335A attributes its Unitronics PLC attacks to IRGC-affiliated cyber actors, and MITRE tracks it as a suspected IRGC-affiliated group. It reached internet-exposed Unitronics PLCs that had default or no passwords on TCP port 20256 and left the message "Every equipment 'made in Israel' is CyberAv3ngers legal target". Claroty Team82 reported that it allegedly deployed IOControl malware against fuel management systems in Israel and the US. On 2 February 2024 the US Treasury sanctioned six IRGC-CEC officials over the Unitronics hacks, including the IRGC-CEC's head, Hamid Reza Lashgarian.
Attribution
Islamic Revolutionary Guard Corps
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- CISA, FBI, NSA, EPA and INCD (AA23-335A) (Government, 2023-12-01)
Joint advisory: IRGC-affiliated cyber actors using the CyberAv3ngers persona - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Suspected IRGC-affiliated
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| July 2026 US water-utility wave (Minnesota and ~12 states) — CyberAv3ngers claim, no government attributionCLAIMED | 2026-07 | USA | Water/Wastewater | CSIS (2026-08-18); LevelBlue SpiderLabs (2026-08-04) |
| PLC exploitation (Rockwell/Allen-Bradley, Schneider Electric, Siemens) against US critical infrastructure | 2026-03 – ongoing | USA | Water/Wastewater, Energy, Government Services | Unit 42 (2026-04-17); FBI/CISA/NSA/EPA/DOE/CNMF AA26-097A (2026-04-07; updated 2026-07-22: Schneider and Siemens PLCs, safety/alarm logic disabled, IOCs to July 2026) |
| IOControl Fuel Management TargetingASSESSED | 2023-11 – 2024 | Israel, USA | Fuel Management, Energy | Claroty Team82 (2024-12-10) |
| Unitronics Defacement Campaign | 2023-11 – 2024-01 | USA, UK | Water/Wastewater, Energy, Food & Beverage, Healthcare | FBI/CISA/NSA/EPA/INCD AA23-335A (2023-12-01, updated 2024-12-18); MITRE C0031 |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 8
| Initial Access2 | T1078.001Default AccountsT0883Internet Accessible Device |
|---|---|
| Persistence1 | T0889Modify Program |
| Command and Control1 | T1219Remote Access Tools |
| Impact3 | T1565.001Stored Data ManipulationT0829Loss of ViewT0826Loss of Availability |
| Inhibit Response Function1 | T0838Modify Alarm Settings |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| IOControl | ICS Malware (Cisco/CISA AA24-348A) | Linux Embedded |
| Dropbear SSH | Legitimate SSH server deployed on victim endpoints for remote access (port 22) | Linux/Embedded |
Infrastructure patterns
- Telegram channel used to post its attack claims (CISA et al., 2023)
Reporting and advisories 7
- CISA
AA23-335A — IRGC Targeting Unitronics PLCs - Claroty Team82
IOControl Fuel Management Targeting - Unit 42
Rockwell/Allen-Bradley PLC exploitation against US critical infrastructure - CSIS
July 2026 US water-utility wave (Minnesota and ~12 states) — CyberAv3ngers claim, no government attribution - MITRE ATT&CK
CyberAv3ngers (G1027) group profile - CrowdStrike
Hydro Kitten adversary profile - US Treasury (OFAC)
Treasury Sanctions Actors Responsible for Malicious Cyber Activities on Critical Infrastructure (Feb 2024)