Iran’s CyberAv3ngers Escalates Attacks on U.S. Water Utilities and Industrial Systems

CyberAv3ngers, an Iranian state-linked threat group, has intensified disruptive campaigns against U.S. water utilities and industrial control systems, shifting from noisy hacktivism to sustained operational technology (OT) compromises as documented by researchers. The group operates as a state-directed persona for Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC), with U.S. authorities designating it a critical infrastructure threat. Its activities fall under overlapping aliases including Storm-0784, BAUXITE, Hydro Kitten, and UNC5691.

State Sponsorship and Global Reach

U.S. Treasury sanctions in February 2024 targeted six IRGC-CEC officials directing CyberAv3ngers operations, while the U.S. State Department offers a $10 million reward for information on the group’s leadership. Their initial 2023 campaign compromised dozens of internet-exposed Unitronics PLCs using default credentials at water utilities in the U.S., Israel, U.K., and Ireland. Many victims relied on consumer remote-access tools and flat IT/OT networks, creating persistent exposures despite federal warnings.

Evolution to Weaponized Tooling

By mid-2024, the group advanced beyond simple misconfigurations to deploying custom OT attack tools. Claroty’s Team82 documented IOCONTROL, a Linux-based malware targeting routers, PLCs, HMIs, and industrial systems. This platform uses MQTT over TLS (port 8883) for C2 traffic and blends into legitimate network activity while supporting OS command execution and payload deployment.

Exploiting Rockwell’s Unpatchable Flaw

In 2026, CyberAv3ngers leveraged CVE-2021-22681, an unpatchable authentication bypass in Rockwell Automation’s Studio 5000 ecosystem. The flaw, stemming from insufficiently protected cryptographic keys, enables attackers to manipulate PLC logic and project files over EtherNet/IP (TCP 44818). A joint FBI/CISA advisory (AA26-097A) confirmed Iran-affiliated actors are exploiting internet-facing Rockwell/Allen-Bradley devices across water, energy, and government sectors, causing operational disruption.

A Proliferating Threat Ecosystem

Even if disrupted, the threat persists through a “swarm” of over 60 pro-Iranian groups adopting CyberAv3ngers’ techniques. This ecosystem enables less experienced actors to launch PLC-focused attacks. Concurrently, the group runs influence operations recycling old breach data to exaggerate impact. Defenders should treat public claims with skepticism and seek technical validation.

Critical Mitigation Steps

Operators of internet-exposed PLCs—especially Rockwell Logix and Unitronics devices—must take immediate action:

• Isolate infrastructure: Disconnect PLCs from the public internet
• Secure access: Enforce MFA for remote access and segregate engineering networks
• Harden configurations: Set PLC mode switches to Run, back up logic offline
• Monitor threats: Deploy CISA AA26-097A IoCs and watch for suspicious traffic on TCP 44818 (EtherNet/IP), 8883 (MQTT over TLS), and DoH

With an unpatchable Rockwell flaw weaponized by a state actor and an expanding network of affiliates, this represents one of the most serious Iranian cyber threats ever against U.S. critical infrastructure. The convergence of OT vulnerabilities, state-sponsored campaigns, and attacker collaboration demands immediate defensive escalation.