Glossary term
Critical infrastructure
Critical infrastructure means the systems and assets, physical or virtual, that are so vital that losing them would seriously harm security, the economy, or public health and safety.
Read more
Significant cyber incident
CyberAv3ngers attacks on Unitronics PLCs, 2023
CyberAv3ngers is an Iranian IRGC-affiliated persona that claimed attacks on Israeli water, energy and shipping PLCs from September 2023.
In short
CyberAv3ngers is an Iranian IRGC-affiliated persona that claimed attacks on Israeli water, energy and shipping PLCs from September 2023. From 22 November 2023 it is reported to have defaced Israeli-made Unitronics Vision Series controllers at US water and other facilities. Joint advisory AA23-335A says the actors logged in to internet-exposed devices with default or no passwords. A weak password on an exposed industrial controller can do real damage.
What happened
Between 13 September and 30 October 2023, a Telegram channel run by a persona called CyberAv3ngers posted claims of attacks on Israeli PLCs in the water, energy, shipping and distribution sectors. The joint advisory says some claims were real and some were false. It adds that the persona has made claims against Israel since 2020, and several of those were false.
From 22 November 2023 the advisory reports access to several US water and wastewater facilities that run HMI-capable Unitronics Vision Series PLCs. The screens showed a defacement message saying equipment made in Israel was a legal target. On 28 November 2023 CISA said one municipal water authority in the US had taken its system offline and switched to manual operation, with no known risk to drinking water.
The updated advisory of 18 December 2024 says the activity ran from November 2023 to January 2024 in likely four waves. It counts at least 75 compromised devices, at least 34 of them in US water. The victims spanned several US states and other countries. The PLCs are also used in energy, food and beverage manufacturing, transport and healthcare.
The US Treasury then sanctioned six officials of the IRGC Cyber-Electronic Command on 2 February 2024. It said this operation did not disrupt any critical services.
Timeline
-
2020
The advisory says CyberAv3ngers has claimed attacks in Israel since 2020; several claims are false.
-
13 September to 30 October 2023
The CyberAv3ngers Telegram channel shows real and false claims against Israeli PLCs in the water, energy, shipping and distribution sectors.
-
October 2023
The persona claims on Telegram attacks on Israel-based PLCs that used default passwords or none.
-
22 November 2023
Actors access several US water and wastewater facilities running Unitronics Vision Series PLCs.
-
28 November 2023
CISA publishes an alert on active exploitation of Unitronics PLCs in the water sector.
-
1 December 2023
The joint advisory AA23-335A is first published by US, Israeli, Canadian and UK agencies.
-
19 December 2023
CISA adds an update telling owners to install the latest Unitronics PLC and HMI version.
-
January 2024
End of the period of four likely waves of attacks on US Unitronics devices (November 2023 to January 2024).
-
2 February 2024
US Treasury sanctions six IRGC-CEC officials over the Unitronics operation.
-
18 December 2024
The advisory is updated with the extent of activity (at least 75 devices) and new techniques.
How the attack worked
Finding exposed devices
CISA said on 28 November 2023 that actors were actively targeting the default Unitronics TCP port after finding it through network probing. The advisory says the actors then authenticated to internet-connected devices on that port. The devices had a default password or none. The advisory maps this to Brute Force (T1110) and Default Accounts (T1078.001). MITRE lists the Unitronics Defacement Campaign as an example of Internet Accessible Device (T0883) in the ICS matrix.
Taking over the controller
The advisory lists what the actors changed. They erased the original ladder logic and loaded their own file, which had no inputs or outputs. They renamed the devices, set the software version to an older one, disabled upload and download, turned on a password for upload settings and moved the remote port from 20256 to 20257. These steps delayed or blocked operators from reconnecting. The advisory maps this to Stored Data Manipulation (T1565.001), Account Access Removal (T1531) and Endpoint Denial of Service (T1499).
Defacing the screen
The actors loaded a splash page with the defacement message on the HMI screen. Operators could not read normal inputs and outputs. The advisory maps this to Internal Defacement (T1491.001). It says the actors wrote custom ladder logic for each device type, including older models, and that deeper access could allow more serious cyber-physical effects.
- Find exposed PLCProbe the internet for the default Unitronics portTechnique T1110 (MITRE ATT&CK, opens in a new tab)
- Log inUse the default or empty passwordTechnique T1078.001 (MITRE ATT&CK, opens in a new tab)
- Replace logicErase the ladder logic and load their ownTechnique T1565.001 (MITRE ATT&CK, opens in a new tab)
- Lock out operatorsRename the device, disable upload, change the portTechnique T1531 (MITRE ATT&CK, opens in a new tab)
- Deface HMIShow the defacement splash page on the screenTechnique T1491.001 (MITRE ATT&CK, opens in a new tab)
ATT&CK techniques
Who says who was behind it
Who attributed it, and how firm it is
CISA, FBI, NSA, EPA, Israel National Cyber Directorate, CCCS and UK NCSC, 1 December 2023 (updated 18 December 2024): the activity was by IRGC-affiliated cyber actors using the persona CyberAv3ngers. The advisory says the actors are IRGC-affiliated APT cyber actors.
US Treasury, 2 February 2024: sanctioned six IRGC-CEC officials in response to IRGC-affiliated actors' operations against Unitronics PLCs. The release does not use the CyberAv3ngers name in the text opened.
The advisory notes that some CyberAv3ngers claims on Telegram are false, so claims alone are not proof of an attack.
No bd_apt profile exists for this persona, so no group is linked.
Impact
Sources state the following. The advisory counts at least 75 compromised devices between November 2023 and January 2024, including at least 34 in US water. Victims spanned several US states and foreign countries. One US municipal water authority took its system offline and used manual operation in November 2023, with no known risk to drinking water (CISA, 28 November 2023). Treasury said the operation did not disrupt any critical services and the incidents were quickly remediated with minimal impact. Sources do not give figures for Israel. No ransom, data theft or injury is reported in the pages opened.
Government and regulator response
- 28 November 2023: CISA alert urging owners to change default passwords, use multifactor authentication, take PLCs off the open internet and back up logic.
- 1 December 2023: joint advisory AA23-335A from the FBI, CISA, NSA, EPA, the Israel National Cyber Directorate and, in the updated version, Canada and the UK.
- 19 December 2023: CISA update telling owners to install the latest Unitronics PLC and HMI version.
- 2 February 2024: US Treasury sanctions six IRGC-CEC officials. Treasury said the US, with the private sector and other affected countries, quickly remediated the incidents.
- 18 December 2024: advisory update with new techniques, device counts and mitigations.
Lessons
-
Default passwords still open doors
The advisory says the PLCs had default passwords or none. Change them at installation and again on a schedule.
-
Do not expose controllers to the internet
The advisory tells owners to disconnect PLCs from the public internet and to put a firewall or VPN in front of any remote access.
-
Claims can be false
The advisory says some CyberAv3ngers claims were false. Verify a claim against your own logs before acting on it.
-
Keep a recovery copy
The actors replaced the logic file. Tested backups of PLC logic and configuration allow fast recovery.
-
Know where you are exposed
The advisory recommends regular inventory of internet-accessible devices and asset management, including rebranded equipment.
-
Politically timed attacks hit small targets too
Treasury said the operation did not disrupt services, yet it led to sanctions. A defacement still proves control of a device.
What to check in your own organization
-
Exposed PLCs
Search your external address space and ask suppliers whether any PLC or HMI answers from the internet.
-
Default passwords
Check every PLC, HMI and cellular gateway for default or empty passwords, including rebranded devices.
-
Default ports
Check whether remote programming runs on the vendor default port and change it where the vendor allows.
-
Remote access path
Put remote access behind a firewall or VPN with multifactor authentication and an allowlist of source addresses.
-
Firmware and software
Confirm PLCs and engineering software are on the version the vendor advises.
-
Backups
Store a tested copy of PLC logic and configuration and practise a factory reset and reload.
-
Manual mode
Test that operators can run the process manually if the control screen is lost.
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country Israel Israel is a small, highly connected country that faces frequent cyber activity linked to the region's conflicts. Middle East
Questions
Who is CyberAv3ngers?
Joint advisory AA23-335A describes it as an Iranian IRGC-affiliated persona. It was written by US, Israeli, Canadian and UK agencies.
Was drinking water affected?
CISA said in November 2023 that there was no known risk to the drinking water of the one municipality it described. Treasury said the operation did not disrupt any critical services.
Why Unitronics?
The advisory says the actors targeted Israeli-made equipment and the defacement text said equipment made in Israel was a legal target.
How did the actors get in?
They logged in to internet-facing Unitronics PLCs that had default passwords or none, on the default port.
Was Israel also hit?
The persona claimed attacks on Israeli water, energy, shipping and distribution PLCs from 13 September to 30 October 2023. The advisory says some claims were false, and it gives no confirmed Israeli victim count.
Is this the same as the 2026 Iranian PLC attacks?
They are separate cases. See the related page for the 2026 events.
Sources
- IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities (AA23-335A) CISA, FBI, NSA, EPA, INCD, CCCS, NCSC
- Exploitation of Unitronics PLCs used in Water and Wastewater Systems CISA
- Treasury Sanctions Actors Responsible for Malicious Cyber Activities on Critical Infrastructure US Department of the Treasury
- Internet Accessible Device (T0883) MITRE ATT&CK
- Valid Accounts: Default Accounts (T1078.001) MITRE ATT&CK
- Brute Force (T1110) MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.