CyberAv3ngers Threat Actor Profile Guide: IRGC Attacks on Exposed PLCs

CyberAv3ngers have shown that a state-affiliated group does not need malware or zero-days to disrupt water, energy and municipal operations: an internet-facing PLC with a default or missing password is enough. The group is assessed by US and allied agencies as affiliated with the Cyber Electronic Command of Iran's Islamic Revolutionary Guard Corps (IRGC-CEC). Its 2023 campaign defaced and disabled at least 75 Unitronics controllers, and a 2026 joint advisory describes similar activity against Rockwell Automation, Schneider Electric and Siemens PLCs that altered HMI displays and disabled shutdown and alarm logic. This profile covers who the group is, what it targets, its ATT&CK for ICS techniques, the device credentials it relies on, and the detection and hardening steps that stop it. It is for OT engineers, water and energy utility security leads and SOC teams that monitor industrial networks.

Key takeaways

• State-affiliated, hacktivist-styled. CyberAv3ngers present as an anti-Israel persona but are assessed as IRGC-CEC affiliated; the US Treasury sanctioned six IRGC-CEC officials in February 2024 over the Unitronics attacks.
• Exposure plus default credentials is the whole attack. The 2023 campaign used internet-connected Unitronics Vision PLCs with default or no passwords on TCP port 20256; CISA later added the Unitronics insecure default password, CVE-2023-6448, to the KEV catalog.
• Impact has escalated from defacement to process risk. The 2026 advisory AA26-097A, updated July 2026, reports modified project logic, false HMI and SCADA data, and disabled critical shutdown and alarm logic at some victims.
• Small utilities are the typical victims. At least 34 of the 75 devices compromised in 2023 were in the US Water and Wastewater Systems sector, along with energy, food and beverage, transport and healthcare.
• The fixes are basic and cheap. Remove PLCs from the internet, change default passwords, put remote access behind a gateway with MFA, keep RUN mode locked, and hold tested offline backups of logic.

Who they are (names and aliases)

MITRE ATT&CK tracks the group as CyberAv3ngers (G1027) in its ICS matrix, describing a suspected IRGC-affiliated APT group active since at least 2020, with "disputed and false claims" of compromising critical infrastructure in Israel. The joint advisory AA23-335A, last updated 18 December 2024, also spells the persona CyberAveng3rs or Cyber Avengers and reports a connection to Soldiers of Solomon, another IRGC-linked persona.

The 2026 advisory AA26-097A lists the widest set of names for the historical group: Shahid Kaveh Group, Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon and UNC5691, all associated with the IRGC Cyber Electronic Command. Note the attribution nuance: AA26-097A attributes its current campaign to an unnamed Iranian-affiliated APT group and links it to CyberAv3ngers through similar historical activity, rather than naming CyberAv3ngers as the actor.

See the Threat Actor Naming Conventions Guide for how these vendor schemes relate, and the Iran State Cyber Operations Guide for the wider Iranian ecosystem, including the MuddyWater Threat Actor Profile.

Targeting and motivation

• Political signalling: the 2023 HMI defacement read "You have been hacked, down with Israel. Every equipment 'made in Israel' is CyberAv3ngers legal target." Unitronics is an Israeli manufacturer, so devices were chosen by brand, not by victim.
• Opportunistic scale: targets are whatever exposed controllers can be found. AA23-335A reports activity from November 2023 to January 2024 in four waves across the US, Israel and the UK, with at least 75 devices compromised.
• Sectors: Water and Wastewater Systems, energy, food and beverage manufacturing, transportation systems and healthcare in 2023; Government Services and Facilities (including local municipalities), Water and Wastewater and Energy in AA26-097A.
• Disruption over theft: the goal is visible effect and operational disruption. AA26-097A adds project file exfiltration to actor infrastructure and reports operational disruption and financial loss at some victims.
• Exaggeration as a tactic: the agencies stress that many Telegram claims were false. Treat claims as unverified until confirmed on the device.

The behaviour sits between hacktivism and state operations. For the broader pattern see the Hacktivism Guide and the Pro-Russia Hacktivists Targeting OT Guide, which describes a similar exposed-HMI approach.

Tactics and techniques (MITRE ATT&CK)

The table combines the techniques MITRE ATT&CK v20 maps to G1027 and those the two joint advisories list. ICS IDs are from the ATT&CK for ICS matrix; enterprise IDs are from the advisories.

None of this requires exploit code. The KEV entry for CVE-2023-6448 (added 11 December 2023) describes the weakness as Unitronics Vision Series PLCs and HMIs shipping with an insecure default password which, if left unchanged, can allow attackers to execute remote commands.

How they abuse identities and credentials

Every technique above depends on a device identity that nobody owns. PLCs, HMIs and cellular modems are non-human identities: they authenticate engineering software and remote users with a password or key that is set once, usually by an integrator, and rarely changed or recorded.

• Default and blank passwords: AA23-335A says access came through devices "using default or no passwords". The first mitigation it lists is replacing all default passwords on PLCs and HMIs, including the Unitronics default.
• Credential takeover as lock-out: by setting their own upload password and changing port and device name, the actors turned the device's authentication against its owner (T0892 Change Credential).
• Remote programming without authentication: AA23-335A recommends disabling remote programming or protecting it with a strong password, requiring authentication before any change to controller state, logic or programs, and using centralised authentication for controller accounts.
• Modem and gateway credentials: AA26-097A reports Dropbear SSH on victim modems and asks operators to secure cellular modems with strong authentication, updates, logging and isolated designs such as private APNs or zero trust network access.
• Engineering software as an identity: in 2026 the actors used legitimate vendor tooling (Studio 5000 Logix Designer, EcoStruxure Control Expert, TIA Portal) so connections looked like normal engineering sessions. Host-based allowlists that only accept known engineering workstations defeat this.

See the OT and ICS Identity and Access Guide and the Device and IoT Identity Guide for the identity programme behind these controls.

Notable incidents

Both advisories withhold victim names. NHI Mgmt Group does not hold a breach page for these incidents; the identity lesson, default and unowned device credentials, is the same one shown in the Nissan source code leak and the HPE Aruba Instant On hard-coded credentials case, in IT settings.

Detection and defence

Implementation order

1. Find your exposure (day 1 to 7): inventory every PLC, HMI and cellular modem and check which answer from the internet on ports 20256, 44818, 2222, 102, 502 or 22. CISA's free Cyber Hygiene scanning can do the external check. Use the OT Asset Visibility Guide for the internal inventory.
2. Back up first: before changing anything, take and verify offline backups of controller logic and configuration, so a bad change can be rolled back. AA26-097A asks operators to verify backups before restoring them.
3. Remove direct exposure: disconnect PLCs from the public internet and route any remote access through a secure gateway or jump host with firewall rules that block brute force and hosting-provider ranges. See the OT Remote Access Guide.
4. Fix the credentials: change every default password, set project file protection, disable unused authentication methods and services (Telnet, FTP, RDP, VNC, web services), and record each credential with an owner in a vault.
5. Lock the controller: keep Rockwell mode switches in RUN outside change windows, enable programming protection in Siemens TIA Portal where available, and validate project files against known-good logic before switching modes.
6. Update: AA23-335A asks for VisiLogic 9.9.00 on engineering workstations and the latest firmware for each Vision model; patch other PLCs in downtime windows, prioritising KEV entries.
7. Add MFA for external OT access and confirm integrators and vendors apply the same controls on their remote connections.

What to monitor

• Network: connections to PLC ports from outside the OT network, standard ICS protocols on non-standard ports, unexpected internet-facing protocols, and ICS functions that change operating mode or download programs.
• Configuration: changes in asset management or project repositories that do not match a change ticket; device renames; port changes.
• Process: HMI values that disagree with independent sensors or field readings; alarms or shutdown logic disabled.
• Indicators: the IP addresses in AA26-097A Tables 1 and 2, with their association dates; validate before blocking.

Metrics

1. Internet-reachable PLC, HMI and modem count (target: zero).
2. Percentage of controllers with default credentials changed and recorded with an owner.
3. Percentage of controllers with a verified offline logic backup less than 90 days old.
4. Percentage of remote OT sessions through the gateway with MFA.
5. Time to detect an unauthorised program download in exercises.

Common failure patterns

• Integrator defaults left in place: devices commissioned with vendor passwords that the asset owner never learnt or changed.
• "Temporary" remote access: port forwarding for a contractor that became permanent internet exposure.
• Cellular modems outside the inventory: SIM-based connections that bypass the firewall and are not logged.
• No usable backup: logic only on the device, so a wiped program means hours or days of manual operation.
• Believing or dismissing claims without checking: both errors happen; verify on the device.

Framework mapping

For the full CPG set see the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide; vendor-specific hardening is in the Rockwell ControlLogix and FactoryTalk Hardening Guide and the Siemens SIMATIC S7 and TIA Portal Hardening Guide.

Small versus large operators

A small water system with a handful of controllers gets most of the benefit from three actions: no internet exposure, changed passwords and an offline backup. Larger utilities should add OT network monitoring for program downloads and mode changes, a vault for device credentials, and contract clauses requiring integrators to meet the same controls. See the Water and Wastewater Cybersecurity Guide.

Practitioner checklist

• Confirm no PLC, HMI or modem answers from the internet on 20256, 44818, 2222, 102, 502 or 22.
• Take and verify offline backups of all controller logic before making changes.
• Change every default PLC and HMI password and record each credential with an owner.
• Route all remote OT access through a gateway or jump host with MFA and brute-force blocking.
• Restrict PLC connections to known engineering workstations with host allowlists.
• Keep controller mode switches in RUN outside approved change windows.
• Secure, inventory and log cellular modems.
• Alert on program downloads, mode changes and ICS protocols on unexpected ports.
• Check logs against the AA26-097A indicators and their date ranges.
• Exercise recovery from a wiped or altered PLC program with the OT Incident Response Guide.

Standards and references

• CISA, FBI, NSA, EPA and partners: AA23-335A IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities
• FBI, CISA, NSA, EPA, DOE, CNMF and Treasury: AA26-097A Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
• MITRE ATT&CK: CyberAv3ngers (G1027)
• MITRE ATT&CK for ICS: Internet Accessible Device (T0883)
• CISA: Known Exploited Vulnerabilities Catalog (CVE-2023-6448)
• US Department of the Treasury: Sanctions on IRGC Cyber-Electronic Command Officials
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: PLC Security Guide · Hacktivism Guide · Iran State Cyber Operations Guide · OT and ICS Identity and Access Guide · Water and Wastewater Cybersecurity Guide