CyberAv3ngers

Actor Type Nation State
Attributed to Nation Iran
Associated Threat Actor Islamic Revolutionary Guard Corps (IRGC)

The CyberAv3ngers (Cyber Av3ngers) are an Iranian intrusion set affiliated with the Islamic Revolutionary Guard Corps (IRGC). They are known for targeting critical infrastructure, particularly in the U.S., and have a history of cyber attacks (or claims of cyber attacks) dating back to 2020.

In 2023, the group exploited Israeli manufactured Programmable Logic Controllers (PLCs) used in Water and Wastewater treatment plants. The group exploited default passwords and well-documented ports which were publicly accessible to gain control over systems. After gaining access to systems, they defaced user interfaces, leaving messages indicating their intrusion.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

CyberAv3ngers Threat Reports

Report

IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities

This advisory from CISA and partners describes activity by IRGC-affiliated cyber actors "CyberAv3ngers". According to the advisory, the ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

ATT&CK ID Title Associated Tactics
T1110 Brute Force Credential Access