Quick links
Press Enter to search, Esc to close
Significant cyber incident
CyberAv3ngers is an Iranian IRGC-affiliated persona that claimed attacks on Israeli water, energy and shipping PLCs from September 2023.
In short
CyberAv3ngers is an Iranian IRGC-affiliated persona that claimed attacks on Israeli water, energy and shipping PLCs from September 2023. From 22 November 2023 it is reported to have defaced Israeli-made Unitronics Vision Series controllers at US water and other facilities. Joint advisory AA23-335A says the actors logged in to internet-exposed devices with default or no passwords. A weak password on an exposed industrial controller can do real damage.
Between 13 September and 30 October 2023, a Telegram channel run by a persona called CyberAv3ngers posted claims of attacks on Israeli PLCs in the water, energy, shipping and distribution sectors. The joint advisory says some claims were real and some were false. It adds that the persona has made claims against Israel since 2020, and several of those were false.
From 22 November 2023 the advisory reports access to several US water and wastewater facilities that run HMI-capable Unitronics Vision Series PLCs. The screens showed a defacement message saying equipment made in Israel was a legal target. On 28 November 2023 CISA said one municipal water authority in the US had taken its system offline and switched to manual operation, with no known risk to drinking water.
The updated advisory of 18 December 2024 says the activity ran from November 2023 to January 2024 in likely four waves. It counts at least 75 compromised devices, at least 34 of them in US water. The victims spanned several US states and other countries. The PLCs are also used in energy, food and beverage manufacturing, transport and healthcare.
The US Treasury then sanctioned six officials of the IRGC Cyber-Electronic Command on 2 February 2024. It said this operation did not disrupt any critical services.
The advisory says CyberAv3ngers has claimed attacks in Israel since 2020; several claims are false.
The CyberAv3ngers Telegram channel shows real and false claims against Israeli PLCs in the water, energy, shipping and distribution sectors.
The persona claims on Telegram attacks on Israel-based PLCs that used default passwords or none.
Actors access several US water and wastewater facilities running Unitronics Vision Series PLCs.
CISA publishes an alert on active exploitation of Unitronics PLCs in the water sector.
The joint advisory AA23-335A is first published by US, Israeli, Canadian and UK agencies.
CISA adds an update telling owners to install the latest Unitronics PLC and HMI version.
End of the period of four likely waves of attacks on US Unitronics devices (November 2023 to January 2024).
US Treasury sanctions six IRGC-CEC officials over the Unitronics operation.
The advisory is updated with the extent of activity (at least 75 devices) and new techniques.
CISA said on 28 November 2023 that actors were actively targeting the default Unitronics TCP port after finding it through network probing. The advisory says the actors then authenticated to internet-connected devices on that port. The devices had a default password or none. The advisory maps this to Brute Force (T1110) and Default Accounts (T1078.001). MITRE lists the Unitronics Defacement Campaign as an example of Internet Accessible Device (T0883) in the ICS matrix. For a November 2026 case of exposed refrigeration controllers, see the second wave of refrigeration controller attacks.
The advisory lists what the actors changed. They erased the original ladder logic and loaded their own file, which had no inputs or outputs. They renamed the devices, set the software version to an older one, disabled upload and download, turned on a password for upload settings and moved the remote port from 20256 to 20257. These steps delayed or blocked operators from reconnecting. The advisory maps this to Stored Data Manipulation (T1565.001), Account Access Removal (T1531) and Endpoint Denial of Service (T1499).
The actors loaded a splash page with the defacement message on the HMI screen. Operators could not read normal inputs and outputs. The advisory maps this to Internal Defacement (T1491.001). It says the actors wrote custom ladder logic for each device type, including older models, and that deeper access could allow more serious cyber-physical effects.
Who attributed it, and how firm it is
CISA, FBI, NSA, EPA, Israel National Cyber Directorate, CCCS and UK NCSC, 1 December 2023 (updated 18 December 2024): the activity was by IRGC-affiliated cyber actors using the persona CyberAv3ngers. The advisory says the actors are IRGC-affiliated APT cyber actors.
US Treasury, 2 February 2024: sanctioned six IRGC-CEC officials in response to IRGC-affiliated actors' operations against Unitronics PLCs. The release does not use the CyberAv3ngers name in the text opened.
The advisory notes that some CyberAv3ngers claims on Telegram are false, so claims alone are not proof of an attack.
No bd_apt profile exists for this persona, so no group is linked.
Sources state the following. The advisory counts at least 75 compromised devices between November 2023 and January 2024, including at least 34 in US water. Victims spanned several US states and foreign countries. One US municipal water authority took its system offline and used manual operation in November 2023, with no known risk to drinking water (CISA, 28 November 2023). Treasury said the operation did not disrupt any critical services and the incidents were quickly remediated with minimal impact. Sources do not give figures for Israel. No ransom, data theft or injury is reported in the pages opened.
The advisory says the PLCs had default passwords or none. Change them at installation and again on a schedule.
The advisory tells owners to disconnect PLCs from the public internet and to put a firewall or VPN in front of any remote access.
The advisory says some CyberAv3ngers claims were false. Verify a claim against your own logs before acting on it.
The actors replaced the logic file. Tested backups of PLC logic and configuration allow fast recovery.
The advisory recommends regular inventory of internet-accessible devices and asset management, including rebranded equipment.
Treasury said the operation did not disrupt services, yet it led to sanctions. A defacement still proves control of a device.
Search your external address space and ask suppliers whether any PLC or HMI answers from the internet.
Check every PLC, HMI and cellular gateway for default or empty passwords, including rebranded devices.
Check whether remote programming runs on the vendor default port and change it where the vendor allows.
Put remote access behind a firewall or VPN with multifactor authentication and an allowlist of source addresses.
Confirm PLCs and engineering software are on the version the vendor advises.
Store a tested copy of PLC logic and configuration and practise a factory reset and reload.
Test that operators can run the process manually if the control screen is lost.
Joint advisory AA23-335A describes it as an Iranian IRGC-affiliated persona. It was written by US, Israeli, Canadian and UK agencies.
CISA said in November 2023 that there was no known risk to the drinking water of the one municipality it described. Treasury said the operation did not disrupt any critical services.
The advisory says the actors targeted Israeli-made equipment and the defacement text said equipment made in Israel was a legal target.
They logged in to internet-facing Unitronics PLCs that had default passwords or none, on the default port.
The persona claimed attacks on Israeli water, energy, shipping and distribution PLCs from 13 September to 30 October 2023. The advisory says some claims were false, and it gives no confirmed Israeli victim count.
They are separate cases. See the related page for the 2026 events.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
