Iran-linked Cyber Av3ngers targets Israeli-made Unitronics PLCs and deploys IOCONTROL malware against OT/IoT devices.
Cyber Av3ngers is a threat actor affiliated with Iran's IRGC Cyber-Electronic Command, known for targeting internet-exposed operational technology (OT) and industrial control systems (ICS). They primarily focus on Israeli-made Unitronics PLCs and HMIs, with broader activity aimed at critical infrastructure sectors. Their key TTPs include compromising Unitronics devices and deploying the IOCONTROL malware against IoT and OT devices. Defenders should prioritize inventorying internet-facing OT/ICS equipment, securing Unitronics products, and monitoring for IOCs related to IOCONTROL.
Cyber Av3ngers is an Iranian IRGC Cyber-Electronic Command-affiliated threat actor that targets internet-exposed operational technology and industrial control systems. Public reporting documents disruptive targeting of Israeli-made Unitronics PLCs and HMIs, broader critical-infrastructure targeting, and use of the IOCONTROL malware against IoT and OT devices.
The group primarily targets Israeli-made Unitronics PLC and HMI devices.
One of their key TTPs involves deploying the IOCONTROL malware against IoT and OT devices.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.