CyberAv3ngers
Also known as: Soldiers of Soloman
CyberAv3ngers presents itself as a hacktivist group, but US and allied agencies tie it to the IRGC. Its best-known activity was simple: it found Israeli-made Unitronics PLCs exposed to the internet with default or no passwords and defaced their screens, including at US water facilities. Some of its other claims have been assessed as false.
- Public attribution
- Publicly attributed by the FBI, CISA, NSA and partners as a persona used by cyber actors affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC).
- Active since
- Around 2020
- Targets
- Internet-exposed programmable logic controllers (PLCs) and HMIs
- Water and wastewater, energy, food and healthcare facilities
- Israeli-made equipment wherever it is deployed
Notable campaigns
2023Unitronics PLC compromises
From November 2023, the actors compromised Unitronics Vision Series PLCs in multiple countries, leaving a defacement image (AA23-335A).
Signature ATT&CK techniques
- T0883Internet Accessible Device
- T0892Change Credential
- T0829Loss of View
- T0826Loss of Availability
- T0814Denial of Service
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Take PLCs and HMIs off the public internet; put any remote access behind a VPN or gateway with MFA.
- Change default passwords on every OT device and disable unused default ports.
- Back up PLC logic and configurations so devices can be restored quickly.
- Use asset discovery or internet scanning to find your own exposed devices before attackers do.