Quick links
Press Enter to search, Esc to close
Threat group profile
CyberAv3ngers (also called Shahid Kaveh Group in a 2026 advisory) is attributed by US, Israeli, Canadian and UK agencies to the Iranian IRGC, and is tied to defacing internet-exposed industrial controllers at US water facilities from November 2023.
In short
CyberAv3ngers (also called Shahid Kaveh Group in a 2026 advisory) is attributed by US, Israeli, Canadian and UK agencies to the Iranian IRGC, and is tied to defacing internet-exposed industrial controllers at US water facilities from November 2023. A 2026 US advisory on Iranian-affiliated attacks on US industrial controllers refers to this group as earlier activity but does not say the two are the same.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| CyberAv3ngers | MITRE ATT&CK G1027 (group name); AA23-335A; Rewards for Justice[1, 2, 4] |
| CyberAveng3rs | AA23-335A (also known as)[2] |
| Cyber Avengers | AA23-335A (also known as)[2] |
| Shahid Kaveh Group | AA26-097A ("CyberAv3ngers (aka Shahid Kaveh Group)")[5] |
| Soldiers of Soloman | MITRE ATT&CK Associated Groups; MITRE says CyberAv3ngers reportedly has connections to this IRGC-linked group[1] |
| Soldiers of Solomon | AA23-335A and AA26-097A (spelling in the advisories; AA23-335A says "connections to", AA26-097A lists it as a name)[2, 5] |
| Hydro Kitten | AA26-097A (listed as a name used by private industry and open sources)[5] |
| Storm-0784 | AA26-097A (listed as a name used by private industry and open sources)[5] |
| APT Iran | AA26-097A (listed as a name used by private industry and open sources)[5] |
| Bauxite | AA26-097A (listed as a name used by private industry and open sources)[5] |
| UNC5691 | AA26-097A (listed as a name used by private industry and open sources)[5] |
| Mr. Soul | AA26-097A (listed as a name used by private industry and open sources); Rewards for Justice lists it as an associated organization[4, 5] |
| IRGC Cyber-Electronic Command (IRGC-CEC) | Treasury: also known as the IRGC Electronic Warfare and Cyber Defense Organization. Rewards for Justice also lists the IRGC Jangal Organization. This is the unit the sources link to the name, not a name of the group.[3, 4] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK 31 July 2026
Describes CyberAv3ngers as a suspected Iranian Government IRGC-affiliated APT group, known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel. Group page created 25 March 2024, last modified 31 July 2026.[1]
CISA, FBI, NSA, EPA and Israel National Cyber Directorate 1 December 2023
Said IRGC-affiliated cyber actors using the persona "CyberAv3ngers" were actively targeting and compromising Israeli-made Unitronics Vision Series PLCs exposed to the internet.[7]
CISA, FBI, NSA, EPA, Israel National Cyber Directorate, Canadian Centre for Cyber Security and UK NCSC 18 December 2024
Updated advisory calls CyberAv3ngers an Iranian IRGC-affiliated cyber persona and says the agencies assess the observed TTPs are likely associated with this IRGC-affiliated APT.[2]
US Department of the Treasury 2 February 2024
Sanctioned six officials of the IRGC Cyber-Electronic Command (IRGC-CEC) in response to IRGC-affiliated cyber actors' operations against Unitronics PLCs. The release does not use the name CyberAv3ngers.[3]
Rewards for Justice, US Department of State Date not shown on the page
States that CyberAv3ngers is affiliated with the IRGC-CEC and with Mahdi Lashgarian, and used malware known as IOCONTROL. Offers up to 10 million US dollars for information on persons acting for a foreign government in malicious cyber activity against US critical infrastructure.[4]
UK NCSC (in the joint advisory) 18 December 2024
Said it observed targeting of PLC devices, including in the United Kingdom, likely as part of a wider cyber campaign against Israel and Israeli-made technology.[2]
MITRE ATT&CK and the joint advisory 18 December 2024 and 31 July 2026
Both say CyberAv3ngers reportedly has connections to another IRGC-linked group, Soldiers of Solomon (MITRE spells it Soloman).[1, 2]
FBI, CISA, NSA, EPA, DOE, US Cyber Command CNMF and Treasury (AA26-097A) 7 April 2026, updated 22 July 2026
Refer to "CyberAv3ngers (aka Shahid Kaveh Group)" as a cyber threat actor affiliated with the IRGC Cyber Electronic Command (CEC) and say they previously reported on its similar PLC activity.[5]
AA26-097A, published on 7 April 2026 and updated on 22 July 2026, attributes the 2026 attacks on US industrial controllers to "a group of Iranian-affiliated APT actors". It names CyberAv3ngers (aka Shahid Kaveh Group) only as earlier actor whose similar PLC activity the agencies "previously reported on". It does not say the 2026 group is CyberAv3ngers, and this page does not either. The 30 July 2026 CISA alert names no actor at all.
Wording also differs on the name itself: the 2023 and 2024 advisory calls CyberAv3ngers a "persona" of IRGC-affiliated actors, MITRE calls it a "suspected" IRGC-affiliated APT group, and the 2026 advisory calls it a threat actor. The name "Shahid Kaveh Group" appears in AA26-097A but not in the 2023 advisory or on the MITRE page. Treasury's 2 February 2024 sanctions describe IRGC-affiliated cyber actors without using the CyberAv3ngers name; Rewards for Justice links the name to the same IRGC-CEC.
Each entry is attributed to the group by the sources cited.
The CyberAv3ngers Telegram channel showed legitimate and false claims of attacks on Israeli PLCs in water, energy, shipping and distribution.[2]
AA23-335A says the PLCs were internet-facing, used default or no passwords and used default ports, which the actors likely exploited.[2]
CISA warned of active exploitation of Unitronics PLCs in water systems. One US water authority took the system offline and went to manual operation. The alert names no actor.[8]
AA23-335A says CyberAv3ngers targeted US Unitronics PLCs in likely four waves and compromised at least 75 devices, at least 34 of them in the water sector.[2]
CISA, FBI, NSA, EPA and Israel's cyber directorate released the first advisory naming the CyberAv3ngers persona.[7]
Treasury sanctioned six IRGC-CEC officials in response to IRGC-affiliated actors' Unitronics operation.[3]
New details on the extent of the activity, including custom ladder logic for each device type and renamed devices, and new TTPs.[2]
AA26-097A says the agencies assess "a group of Iranian-affiliated APT actors" has disrupted US PLCs since at least March 2026. It says the agencies previously reported on similar PLC activity by CyberAv3ngers (aka Shahid Kaveh Group). It does not say the two are the same. See our incident page "Iranian-affiliated attacks on US industrial controllers".[5]
AA26-097A was widened to cover Schneider Electric and Siemens PLCs and potentially other brands. The update does not name CyberAv3ngers as the actor.[5]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 28 November 2023 | CISA | AlertWarned of active exploitation of Unitronics PLCs in water systems and urged changing default passwords, MFA and disconnecting PLCs from the open internet. Names no actor.[8] |
| 1 December 2023 | CISA, FBI, NSA, EPA and Israel National Cyber Directorate | Joint advisoryReleased AA23-335A on IRGC-affiliated actors using the persona "CyberAv3ngers" and their exploitation of Unitronics PLCs.[7, 2] |
| 2 February 2024 | US Department of the Treasury | SanctionsDesignated six IRGC-CEC officials (Hamid Reza Lashgarian, Mahdi Lashgarian, Hamid Homayunfal, Milad Mansuri, Mohammad Bagher Shirinkar and Reza Mohammad Amin Saberian) and made the IRGC-CEC the primary name on the sanctions list.[3] |
| Date not shown on the page | Rewards for Justice, US Department of State | Reward offerOffers up to 10 million US dollars for information on persons acting for a foreign government in malicious cyber activity against US critical infrastructure, and names CyberAv3ngers and the six IRGC-CEC officials.[4] |
| 18 December 2024 | CISA, FBI, NSA, EPA, Israel National Cyber Directorate, Canadian Centre for Cyber Security and UK NCSC | Updated joint advisoryUpdated AA23-335A with new TTPs, ATT&CK mapping and mitigations.[2] |
| 19 December 2024 | UK NCSC | Statement updateNoted that the updated advisory is co-sealed with international partners and urged organizations to follow its advice.[9] |
| 7 April 2026 | FBI, CISA, NSA, EPA, DOE, US Cyber Command CNMF and Treasury | Joint advisory (AA26-097A)Warned of ongoing Iranian-affiliated targeting of internet-connected PLCs. Refers to CyberAv3ngers as earlier similar activity. Does not state that the 2026 group is CyberAv3ngers.[5] |
| 22 July 2026 | Same agencies | Advisory updateAdded guidance on malicious changes in reusable code modules in Rockwell PLC programs and widened scope to Schneider Electric and Siemens.[5] |
| 30 July 2026 | CISA, with EPA and FBI | AlertUrged water and wastewater operators to protect PLCs after a rise in actors targeting them. Names no actor or country.[6] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Data Manipulation: Stored Data Manipulation T1565.001
AA23-335A says the actors erased the original ladder logic file, loaded their own and set its software version to an older one.[2]
Account Access Removal T1531
AA23-335A says the actors renamed compromised devices and password-protected upload functions so operators could not reach or change them.[2]
Endpoint Denial of Service T1499
AA23-335A says the actors disabled the PLC's upload and download functions and changed the default port from 20256 to 20257.[2]
Defacement: Internal Defacement T1491.001
AA23-335A says the actors loaded a splash page with the defacement message onto the screen so operators could not read normal values.[2]
Loss of Availability T0826
MITRE says multiple businesses halted operations because the PLC and screen were unavailable.[1]
Loss of View T0829
MITRE says the group replaced the graphic on the screen, so owners could not see PLC information.[1]
Loss of Productivity and Revenue T0828
MITRE says the stoppages hurt normal business operations in several sectors.[1]
IOCONTROL Malware
Rewards for Justice says CyberAv3ngers, affiliated with the IRGC-CEC and Mahdi Lashgarian, used this malware against ICS and SCADA devices including routers, PLCs, screens, firewalls, IP cameras and Linux-based IoT platforms.[4]
Custom ladder logic files Malicious PLC program
AA23-335A says the actors made a custom ladder logic file for each Unitronics device type and used it to replace the original program.[2]
Defacement splash page Message loaded on the PLC screen
AA23-335A says the page, with an anti-Israel message, stopped operators reading normal values.[2]
Telegram channel Claims channel
AA23-335A says the group claimed attacks on a Telegram channel from 13 September to 30 October 2023.[2]
Follow new government advisories, the names and tools they attribute to CyberAv3ngers, and whether they mention water, energy and other sectors in your region.
Check which of your internet-facing systems and remote access points are visible from outside, the exposure the advisories ask owners to close.
Keep this actor's advisories next to your own exposure findings, so the advice from CISA and its partners can be checked against your own systems.
CISA, FBI, NSA, EPA and partner agencies call CyberAv3ngers an IRGC-affiliated cyber persona (advisory updated 18 December 2024). MITRE ATT&CK describes it as a suspected IRGC-affiliated APT group, active since at least 2020.
AA26-097A, published on 7 April 2026, writes "CyberAv3ngers (aka Shahid Kaveh Group)" and describes it as affiliated with the IRGC Cyber Electronic Command.
The 2023 advisory says that from 22 November 2023 actors accessed US water facilities that used Unitronics PLCs, likely through default or no passwords. Between November 2023 and January 2024 at least 75 devices were compromised, at least 34 in the US water sector.
The agencies in AA26-097A assess "a group of Iranian-affiliated APT actors" is behind the 2026 activity. They refer to CyberAv3ngers as earlier similar activity but do not say the two are the same, so this page does not either.
The US Treasury sanctioned six IRGC Cyber-Electronic Command officials on 2 February 2024 over IRGC-affiliated actors' Unitronics operation. Rewards for Justice links the name CyberAv3ngers to the same unit and offers up to 10 million US dollars for information.
Take PLCs off the open internet, replace default passwords, and put remote access behind a gateway with multifactor authentication, as the advisories advise.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.