Beware the CyberAv3ngers – GovInfoSecurity

Missile exchanges between Iran and Israel and the prospect of U.S. armed intervention against Tehran has cyber defenders warning that American critical infrastructure could become a target of Iranian hackers.

See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge

In the world ranking of nation-state hackers, Iran is second tier – relying heavily on social engineering, password spraying and multifactor push bombing to penetrate systems. But just because it lacks the sophistication of China or Russia, doesn’t mean it doesn’t get results.

Ask the Municipal Water Authority of Aliquippa, Pennsylvania, which in November 2023 found a hacked pressure-monitoring controller displaying an anti-Israeli message. The attack had no effect on water service or quality, although local media reported that water pressure in two townships briefly dropped – and that recovering from the attack cost the water authority $20,000 (see: Internet-Exposed Water PLCs Are Easy Targets for Iran).

The threat group behind the attack called themselves “CyberAv3ngers.” U.S. federal authorities say the group is the Cyber-Electronic Command of Iran’s Islamic Revolutionary Guard Corps. Its fall 2023 campaign against programmable logic controller systems made by Tel Aviv-based Unitronics defaced at least 75 PLCs, including over 34 in U.S. utilities, said Daniel Dilks, operations director at Sentinel Intelligence.

“They replaced ladder logic and defaced HMIs to disrupt operations,” Dilks said. The hackers took advantage of PLCs directly exposed to the internet and configured with the default password “1111.”

Activity attributed to CyberAv3ngers appears to have since declined. “By end of April 2024, there was a disruption in their methods of communication,” possibly due to “poor OPSEC… which possibly led to them being geo-located and disrupted,” said Yashraj Solanki, threat intelligence analyst at Bridewell. “Their Telegram channel was sold to an Israeli group, and they showcased frustration with the platform,” Solanki said. “The last tweet by the group was on April 23, 2024.”

Researchers cautioned that this does not mean the group has disbanded. “Although no activity has been observed since April 2024, it’s important to remember that a lack of public action doesn’t necessarily indicate inactivity,” said Daniel dos Santos, head of research at Forescout.

The U.S. government is offering up to $10 million for information on CyberAv3ngers, including Hamid Reza Lashgarian, head of IRGC-CEC and a commander in the IRGC-Qods Force. The federal government sanctioned known CyberAv3ngers hackers in February 2024.

A pause in the threat actor’s activity might point to a shift in tactics “toward more covert access and prepositioning,” dos Santos said. He cited custom-built Iranian malware for Internet of Things devices and operational technology dubbed Iocontrol by Claroty in late 2024.

Iocontrol, concurred Danielle Gauthier of Dragos, shows mounting technical depth by Iranian hackers. “Their continued focus on internet-exposed OT systems, including in oil and gas and water sectors, suggests they are neither deterred by international condemnation nor disrupted by countermeasures,” Gauthier warned.

CyberAv3ngers’ Hacking Progress

Early CyberAv3ngers campaigns used basic tools but experts say there’s evidence of a technical evolution. Gavin Knapp, cyberthreat intelligence principal at Bridewell, said that the group began using large language models in 2024. “Their activities on these AI platforms included reconnaissance, querying for vulnerabilities and debugging malicious scripts in bash and Python,” he said.

“They also sought methods for obfuscating code to evade detection and post-compromise activities like password theft,” Knapp added.

Forescout’s dos Santos said the group’s tactics now include “supplanting existing ladder logic files, renaming devices, resetting software versions and disabling upload and download functions.” These behaviors suggest deliberate sabotage and long-term persistence.

In response to the persistent threat, cybersecurity experts issued clear recommendations for critical infrastructure operators.

“Comprehensive preparation plans should include efforts to identify and harden publicly exposed services,” said Mike Arcamone, Chief Strategy Officer at OPSWAT. “Additional high priority actions include identity and credential security, particularly in ensuring that all OT devices do not have default passwords set.”

Dragos recommends operators “harden internet-facing assets, rotate SSH keys, eliminate default credentials and prepare for influence operations, not just technical disruptions.”

Dilks from Sentinel Intelligence advised segmentation, patching, and threat intelligence integration. “Segment OT networks, implement IDS/IPS with signatures for Unitronics scanning and use anomaly detection on PLC telemetry.”

Knapp emphasized hardening the external attack surface and using VPNs with MFA to restrict access. “Reduce the attack surface by disabling unnecessary ports and keep PLC devices updated with the latest patches.”

CyberAv3ngers may not possess the sophistication of Chinese or Russian actors but it’s still a persistent threat.