{ "name": "Adversary Atlas API", "version": "1.0.0", "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.", "generated": "2026-07-31T01:06:07.226Z", "datasetCurrentAsOf": "2025-09-01", "license": "Data compiled from public primary sources; see /methodology/ for sourcing.", "actor": { "id": "cyberav3ngers", "slug": "cyberav3ngers", "name": "CyberAv3ngers", "shortName": "CyberAv3ngers", "country": "Iran", "countryCode": "IR", "sponsorship": "state-sponsored", "status": "active", "activeSince": "2020", "prominence": 76, "tagline": "IRGC cyber unit operating under a hacktivist persona. Defaced water-utility PLCs across the U.S. by exploiting a default password.", "bio": "CyberAv3ngers presents itself as a hacktivist collective. The U.S. Treasury identifies it as the Islamic Revolutionary Guard Corps Cyber-Electronic Command — an official military unit using a persona as cover.\n\nIts November 2023 operation is the clearest recent illustration of how little sophistication a consequential attack on critical infrastructure requires. The group targeted Unitronics Vision series programmable logic controllers — devices that control physical processes at water and wastewater utilities. It did not exploit a memory corruption bug or develop a novel technique. It found internet-exposed PLCs still using the vendor's default password of \"1111,\" logged in, and replaced the operator interface with an anti-Israel message.\n\nThe Municipal Water Authority of Aliquippa in Pennsylvania was among the affected utilities, and had to switch to manual operation. Others were hit across multiple U.S. states. The attack caused no confirmed contamination or water-supply failure — but the same access that defaced a screen could have manipulated pressure, chemical dosing, or pump control.\n\nThe choice of Unitronics equipment appears to have been driven by the manufacturer being Israeli rather than by the strategic value of any particular victim. Small U.S. water utilities, most with no security staff, were collateral in a geopolitical message.\n\nIn February 2024 the U.S. Treasury sanctioned six IRGC-CEC officials, and the State Department's Rewards for Justice programme offered up to $10 million for information on the group.", "attribution": { "sponsor": "Iran", "service": "IRGC — Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC)", "unit": "IRGC-CEC", "confidence": "confirmed", "summary": "The U.S. Department of the Treasury sanctioned six IRGC-CEC officials in February 2024, naming them in connection with the CyberAv3ngers persona and the November 2023 attacks on Unitronics PLCs at U.S. water utilities. A joint advisory from CISA, FBI, NSA, EPA, and the Israel National Cyber Directorate documented the technical detail. The State Department subsequently offered a reward of up to $10 million for information on the actors.", "sources": [ { "org": "U.S. Department of the Treasury", "title": "Treasury Sanctions IRGC Cyber Actors Responsible for Attacks on Critical Infrastructure", "url": "https://home.treasury.gov/news/press-releases/jy2072", "date": "2024-02-02" }, { "org": "CISA / FBI / NSA / EPA / INCD", "title": "IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors (AA23-335A)", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a", "date": "2023-12-01" } ] }, "motivations": [ "sabotage", "information-operations", "hacktivism" ], "targetSectors": [ "Water & Wastewater", "Critical Infrastructure", "ICS / SCADA", "Energy", "Manufacturing", "Healthcare", "Government" ], "targetCountries": [ "United States", "Israel", "Ireland" ], "aliases": [ { "org": "microsoft", "name": "CyberAv3ngers", "correlation": "exact" }, { "org": "cisa", "name": "CyberAv3ngers / IRGC-CEC", "correlation": "exact" }, { "org": "crowdstrike", "name": "CyberAv3ngers", "correlation": "exact" }, { "org": "dragos", "name": "BAUXITE", "correlation": "partial", "note": "Dragos assesses BAUXITE as overlapping with CyberAv3ngers activity against ICS" }, { "org": "mandiant", "name": "CyberAv3ngers", "correlation": "exact" }, { "org": "unit42", "name": "CyberAv3ngers", "correlation": "exact" } ], "tools": [ { "name": "Default credentials", "type": "lotl", "custom": false, "description": "The primary technique — internet-exposed Unitronics PLCs still using the vendor default password '1111'." }, { "name": "IOCONTROL", "type": "malware", "custom": true, "description": "Modular Linux implant for IoT and OT devices — routers, PLCs, HMIs, fuel management systems — using MQTT for C2." }, { "name": "Shodan / internet scanning", "type": "utility", "custom": false, "description": "Mass identification of internet-exposed industrial devices by vendor and model." }, { "name": "HMI defacement", "type": "utility", "custom": false, "description": "Replacement of operator interface screens with political messaging, visible to plant staff." } ], "techniques": [ { "tCode": "T1595.002", "name": "Active Scanning: Vulnerability Scanning", "tactic": "Reconnaissance", "note": "Internet-wide scanning for exposed Unitronics and similar devices" }, { "tCode": "T1078.001", "name": "Valid Accounts: Default Accounts", "tactic": "Initial Access", "note": "Vendor default password on internet-exposed PLCs" }, { "tCode": "T1133", "name": "External Remote Services", "tactic": "Initial Access", "note": "PLCs directly exposed to the internet on default ports" }, { "tCode": "T0822", "name": "External Remote Services", "tactic": "Initial Access", "note": "ICS technique — direct access to control equipment" }, { "tCode": "T0832", "name": "Manipulation of View", "tactic": "Impact", "note": "ICS technique — HMI defacement altering what operators see" }, { "tCode": "T0816", "name": "Device Restart/Shutdown", "tactic": "Impact", "note": "ICS technique — forcing utilities into manual operation" }, { "tCode": "T1491.002", "name": "Defacement: External Defacement", "tactic": "Impact" }, { "tCode": "T1071", "name": "Application Layer Protocol", "tactic": "Command and Control", "note": "MQTT used by IOCONTROL for device C2" } ], "cves": [ { "cveId": "CVE-2023-6448", "firstExploited": "2023-11-22", "usage": "Unitronics Vision PLCs shipping with the default password '1111' and exposed directly to the internet. No exploit development required — the group logged in and replaced the operator interface. Multiple U.S. water utilities were forced to manual operation.", "source": { "org": "CISA / FBI / NSA / EPA / INCD", "title": "IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors (AA23-335A)", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a", "date": "2023-12-01" } } ], "relationships": [ { "relatedActorId": "apt35", "type": "same-sponsor", "confidence": "moderate", "note": "Both IRGC-linked; CyberAv3ngers operates against ICS under a hacktivist persona." }, { "relatedActorId": "apt33", "type": "same-sponsor", "confidence": "moderate", "note": "Both Iranian actors willing to cross from collection into disruptive effect." }, { "relatedActorId": "predatory-sparrow", "type": "operational-overlap", "confidence": "low", "note": "Adversaries, not associates — both operate under hacktivist personas in the Iran–Israel exchange, on opposite sides." } ], "reports": [ { "org": "CISA and partners", "title": "AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a", "date": "2023-12-01" }, { "org": "U.S. Department of the Treasury", "title": "Treasury Sanctions IRGC-CEC Officials for Attacks on Critical Infrastructure", "url": "https://home.treasury.gov/news/press-releases/jy2072", "date": "2024-02-02" }, { "org": "Claroty Team82", "title": "IOCONTROL: Inside the Iranian-Made Malware Targeting Critical Infrastructure", "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyberweapon-iocontrol", "date": "2024-12-12" } ], "campaigns": [ { "id": "unitronics-water", "actorId": "cyberav3ngers", "name": "U.S. Water Utility PLC Defacements", "date": "2023-11-22", "significance": "major", "targetSectors": [ "Water & Wastewater", "Critical Infrastructure" ], "targetCountries": [ "United States", "Israel", "Ireland" ], "cveIds": [ "CVE-2023-6448" ], "summary": "Compromise of internet-exposed Unitronics PLCs at water and wastewater utilities across multiple U.S. states using the vendor's default password. The Municipal Water Authority of Aliquippa was forced to manual operation. The equipment was selected because the manufacturer is Israeli, not because the victims mattered.", "sources": [ { "org": "CISA / FBI / NSA / EPA / INCD", "title": "AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a", "date": "2023-12-01" } ] } ], "flag": "🇮🇷", "profile": "/apt/cyberav3ngers/" } }