(CISA) The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), and the Israel National Cyber Directorate (INCD)—hereafter referred to as 'the authoring agencies'—are disseminating this joint Cybersecurity Advisory (CSA) to highlight continued malicious cyber activity against operational technology devices by Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated Advanced Persistent Threat (APT) cyber actors. The IRGC is an Iranian military organization that the United States designated as a foreign terrorist organization in 2019. IRGC-affiliated cyber actors using the persona “CyberAv3ngers” are actively targeting and compromising Israeli-made Unitronics Vision Series programmable logic controllers (PLCs). These PLCs are commonly used in the Water and Wastewater Systems (WWS) Sector and are additionally used in other industries including, but not limited to, energy, food and beverage manufacturing, and healthcare. The PLCs may be rebranded and appear as different manufacturers and companies.
The U.S. Justice Department has charged 17 Iranians linked to Iran’s military for a sprawling hacking campaign targeting U.S. government agencies, universities, and companies since 2013. The campaign, allegedly orchestra…
A coordinated campaign targeting water and wastewater systems across multiple states is underway, potentially linked to Iran and the CyberAv3ngers hacktivist group. Threat actors are exploiting poorly secured PLCs – indu…
A coordinated cyberattack targeting over 30 community water systems in Minnesota, potentially linked to Iran-backed actors, highlighted the vulnerability of critical infrastructure to state-sponsored cyber espionage. The…
Iranian-linked cyber actors, believed to be part of the CyberAv3ngers group, are suspected of launching attacks against Minnesota water systems. This indicates a broader trend of state-sponsored cyber activity targeting…
A coordinated cyberattack targeted over 30 community water systems in Minnesota, leading to operational disruptions and communications failures. While the exact number of compromised systems remains unclear, the attacks…
A DomainTools report details ongoing nation-state targeting of water systems by Iran, Russia, and China, primarily through exploiting weak passwords, exposed PLCs, and HMI vulnerabilities. The motivations behind these at…
