CyberAv3ngers
CyberAv3ngers is an Iranian threat actor active since at least 2023 and assessed to operate under or in coordination with the Islamic Revolutionary Guard Corps (IRGC), specifically the IRGC Cyber Electronic Command (CEC). The group is also described as the IRGC Cyber-Electronic Command’s industrial-control-system arm and as operating under hacktivist branding for deniability. Known aliases in the provided content include Shahid Kaveh Group, Storm-0784, Bauxite, and UNC5691. The group focuses on operational technology and industrial control systems, particularly programmable logic controllers (PLCs), internet-exposed industrial devices, and HMI/SCADA environments. Reported targeting includes water and wastewater systems, energy facilities, government services and facilities, and other critical infrastructure in the United States, Israel, Ireland, and elsewhere. The content states that CyberAv3ngers previously compromised at least 75 Unitronics Vision Series PLCs, including U.S. water and wastewater entities, and that the group has been linked to exploitation of Rockwell Automation/Allen-Bradley PLCs since at least March 2026. Observed activity in the provided content includes defacement of Israeli-made digital control panels at multiple U.S. water treatment facilities in Pennsylvania in 2023; targeting of Unitronics devices using default administrative passwords; exploitation of internet-facing PLCs and industrial control devices; manipulation of HMI/SCADA display data; extraction of PLC project configuration files; and disruptive activity affecting water infrastructure. The content also notes abuse of Rockwell Automation FactoryTalk software and use of Rockwell Studio 5000 Logix Designer to connect to exposed PLCs. Multiple sources in the content characterize the group’s trajectory as moving from hacktivist posturing to confirmed state-linked OT-focused operations. The group has also publicly claimed operations against Israeli infrastructure, including Noga, Dorad, Mekorot, and ORPAK, though one analysis in the content concludes that the Dorad claim reused older leaked material and did not reflect new unauthorized access. The content further states that CyberAv3ngers has targeted water infrastructure across the region and that U.S. authorities linked similar PLC-targeting activity in 2026 to Iranian-affiliated actors previously tracked as CyberAv3ngers.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
37 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Then in early 2026, CyberAv3ngers shifted to Rockwell Automation Logix controllers, exploiting CVE-2021-22681 — a critical authentication bypass flaw with a CVSS score of 9.8. This vulnerability lets an attacker who intercepts a single cryptographic key connect to affected PLCs without valid credentials. Rockwell Automation has confirmed that no software patch exists for it, and affected controller families include CompactLogix, ControlLogix, GuardLogix, DriveLogix, and SoftLogix.
On Monday, the U.S. Cybersecurity and Infrastructure Security Agency added the Unitronics bug to its Known Exploited Vulnerabilities catalog, assigning it CVE-2023-6448. The advisory warned that “Unitronics Vision Series PLCs and HMIs [Human Machine Interfaces] use default administrative passwords.” “An unauthenticated attacker with network access to a PLC or HMI can take administrative control of the system,” the agency said.
Observables
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iranian IRGC-linked ICS-focused threat actor targeting internet-exposed PLCs and municipal critical infrastructure, especially water, wastewater, and energy systems relevant to host cities.
Targeting water and energy infrastructure, including programmable logic controllers and digital control panels at U.S. water treatment plants.
IRGC-linked Iranian cyber operations group referenced for contrast with Handala's MOIS affiliation.
Iran-linked group targeting industrial control environments, particularly water utilities, energy facilities, and other industrial sites, including abuse of Rockwell Automation/Allen-Bradley and prior campaigns exploiting Unitronics PLC weaknesses.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.