Iran's CyberAv3ngers Group Attacks Industrial Systems on a Global Scale

Not subscribed to RECON? Sign Up Today!

In an era where geopolitical tensions increasingly spill into cyberspace, a new wave of attacks has emerged from a group calling itself CyberAv3ngers—a threat actor believed to have ties to Iran’s Islamic Revolutionary Guard Corps. In recent weeks, this group has launched a string of cyber intrusions targeting industrial control systems (ICS) across the globe, with a particular focus on water and energy infrastructure. What makes these attacks alarming isn’t just the volume—it’s the simplicity. By exploiting default passwords and unsecured Internet-facing devices, CyberAv3ngers is proving that critical infrastructure doesn’t always need advanced exploits to be dangerously vulnerable. As these intrusions grow in scope and ambition, cybersecurity professionals are being forced to reckon with a hard truth: the weakest link in operational technology is often one that’s been known—and ignored—for years.

Written by: Brandon Gibbons | Founder & CEO - CyberCloak Security Group, LLC

Published: April 14, 2025

Updated: April 14, 2025

-------------------------------------------------------------------------------------------------------------------------------

A Global Threat Emerges

In late 2023, the hacking group known as CyberAv3ngers, affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC), intensified cyberattacks targeting industrial control systems (ICS) worldwide. Their primary focus has been on Israeli-made Unitronics programmable logic controllers (PLCs), which are integral to operations in water treatment, energy, and other critical sectors.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that between November 2023 and January 2024, CyberAv3ngers compromised at least 75 Unitronics PLC devices across various critical infrastructure industries in the United States, including 34 in the Water and Wastewater Systems (WWS) sector.

One notable incident involved the Municipal Water Authority of Aliquippa (MWAA) in Pennsylvania, where attackers took control of a booster station. Although the MWAA managed to regain control without service interruptions, the breach highlighted vulnerabilities in critical infrastructure systems.

Low-Tech, High Impact: Exploiting the Basics

CyberAv3ngers' tactics are alarmingly straightforward. They identify Internet-exposed Unitronics PLCs, often using tools like Shodan, and exploit them by leveraging default credentials. These PLCs are frequently used in remote locations, making them susceptible to such attacks due to the necessity of remote access. Once accessed, the attackers have been known to deface the human-machine interface (HMI), rendering the devices inoperative and disrupting operations.

Security experts warn that while these attacks may seem unsophisticated, they pose significant risks. The compromised PLCs control essential processes like water treatment and chemical dosing. Disruptions in these systems can have cascading effects, potentially leading to public health crises or environmental hazards. The simplicity of the attack method underscores the critical need for basic cybersecurity hygiene, such as changing default passwords and securing remote access points.

Furthermore, the attackers have utilized custom malware, such as IOControl, to infect devices, enabling covert surveillance and potential future sabotage.

Ideological Motives & Global Implications

CyberAv3ngers' activities are not solely driven by disruption but are also ideologically motivated. Their attacks intensified following geopolitical events, such as the conflict between Hamas and Israel in October 2023. The group has publicly stated that any equipment "made in Israel" is a legitimate target, reflecting their political stance.

The international community has taken notice. U.S. authorities, including the State Department, have offered rewards for information leading to the identification of individuals behind these attacks. Additionally, cybersecurity agencies have issued advisories urging organizations to audit their systems, change default credentials, and implement robust security measures to protect against such threats.

The rise of CyberAv3ngers serves as a stark reminder of the vulnerabilities present in critical infrastructure systems worldwide. As cyber threats continue to evolve, it is imperative for organizations to prioritize cybersecurity, not only to protect their operations but also to safeguard public health and safety.

Stay sharp. Stay secure. Stay cloaked.