Cyber Av3ngersThreat actor
- CyberAv3ngers
- shahid kaveh group
Cyber Av3ngers is an Iranian IRGC Cyber-Electronic Command-affiliated threat actor that targets internet-exposed operational technology and industrial control systems. Public reporting documents disruptive targeting of Israeli-made Unitronics PLCs and HMIs, broader critical-infrastructure targeting, and use of the IOCONTROL malware against IoT and OT devices.From MISP Galaxy
Last reported 11 days ago, by Tenable9 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1684Social Engineering
“Phantom Deal profile: Gen Digital has stumbled upon a cybercrime group that poses as executives who use WhatsApp social-engineering to trick victims into investing or acquiring fake companies.”
- T1110.003Password Spraying
“…y la NSA publicada en octubre de 2024 documentó una campaña de un año en la que actores iraníes usaron password spraying y MFA push‑bombing (inundar a los usuarios con solicitudes de inicio de sesión hasta que alguien apruebe una por error) para…”
- T1195Supply Chain Compromise
“When it comes to attacks that give bad actors a lot of bang for their buck, supply chain compromise typically reigns supreme.”
- T1036Masquerading
“Some hacktivists try to generate hype by posting data from past attacks and masquerading them as recent ones in order to attract attention”
- T1219Remote Access Tools
“If you rely on MSPs, inquire about how they secure their remote access tools and whether they've reviewed their own exposure in light of the conflict.”
- T1505.003Web Shell
“Furthermore, CMS access can be a starting point to infiltrate the web server, often through the uploading of web shells via the compromised CMS.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threats“The tactics, techniques, and procedures (TTPs) are consistent with those employed by the CyberAv3ngers, a nation-state group the U.S.”
-
Risky Bulletin: Russia tells data centers to deploy drone defenses“From his role he directs the activity of multiple Iranian hacking groups, such as the CyberAv3ngers, Shahid Hemmat, and Dadeh Afzar Arman.”
-
Iranian Hackers Target Siemens and Schneider Industrial Systems, CISA Warns“The group in question is commonly known as ‘CyberAv3ngers’ and tracked by cybersecurity companies under many names including Bauxite, Hydro Kitten, the Shahid Kaveh Group, Soldiers of Solomon, Storm-0784 and UNC5691.”
-
Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure“In November 2023, a group affiliated with the Iranian IRGC Cyber Electronic Command (IRGC-CEC), known as CyberAv3ngers (also tracked as Hydro Kitten, Shahid Kaveh Group, and Storm-0784), compromised at least 75 PLCs in U.S.”
-
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters“The advisory described Iranian-affiliated cyber actors and referenced earlier IRGC Cyber-Electronic Command activity associated with CyberAv3ngers.”
-
AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict“In October 2024, OpenAI reported that Iran-linked hacktivist persona “CyberAv3ngers” used ChatGPT to conduct reconnaissance on programmable logic controllers (PLCs), a use case that has continued to bolster Iranian capabilities against industrial control systems (ICS) during 2026…”
-
El impacto en la ciberseguridad de la guerra en Irán: riesgos clave que debe monitorear“La campaña del grupo CyberAv3ngers contra servicios de agua y tratamiento de aguas residuales en Estados Unidos y otros países, durante 2023, ilustró claramente cómo se operacionaliza esa lógica de selección de objetivos.”
-
Cyber fallout from the Iran war: What to have on your radar“The CyberAv3ngers group's campaign against water and wastewater utilities in the US and other countries in 2023 illustrated how that targeting logic is operationalized.”
-
Analyzing cyber activity surrounding the conflict in the Middle East“On October 8, posts appeared in the Telegram channel of the hacktivist group known as Cyber Av3ngers.”
Indicators in its reports
named in the reports above- idscan[.]netin 1 report
- 185.82.73[.]175in 1 report
- 141.11.164[.]153in 1 report
- 175.110.121[.]42in 1 report
- 175.110.121[.]39in 1 report
- 175.110.121[.]107in 1 report
- 185.225.17[.]225in 1 report
- 79.133.46[.]209in 1 report
- 88.80.150[.]199in 1 report
- 88.80.150[.]200in 1 report
- 88.80.150[.]202in 1 report
- 185.82.73[.]162in 1 report
- 185.82.73[.]164in 1 report
- 185.82.73[.]165in 1 report
- 185.82.73[.]167in 1 report
- 185.82.73[.]168in 1 report
- 185.82.73[.]170in 1 report
- 185.82.73[.]171in 1 report
- 135.136.1[.]133in 1 report
- tylarion867mino[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.