CyberAv3ngers Cluster

CyberAv3ngers is an IRGC-linked Iranian hacktivist group that has focused almost exclusively on attacking industrial control systems (ICS) and operational technology (OT) infrastructure, particularly programmable logic controllers (PLCs) used in water and wastewater systems. The group gained significant international attention in late 2023 when it compromised Unitronics PLCs at multiple water utilities across the United States and Israel following the outbreak of the Hamas-Israel conflict.

Targets and Goals

CyberAv3ngers primarily targets Israeli-made or Israeli-affiliated industrial equipment — particularly Unitronics Vision Series PLCs — deployed in critical infrastructure facilities in the United States and other Western countries. The group's attacks align with Iranian state objectives of demonstrating the ability to disrupt Western and Israeli infrastructure, creating psychological impact and signaling Iran's offensive cyber reach into physical systems.

Tooling and Tactics

The group exploits internet-exposed industrial control systems that retain default or weak credentials. In the 2023 US water utility campaign, CyberAv3ngers accessed Unitronics PLCs directly over the internet and displayed anti-Israel messages on human-machine interfaces (HMIs), forcing affected utilities to take systems offline. The US CISA, FBI, EPA, and NSA jointly issued an advisory attributing these attacks to the IRGC. The group also claimed broader attacks on infrastructure in Ireland and other countries.

Attribution

The US Treasury Department sanctioned six IRGC Cyber Command officers linked to CyberAv3ngers in February 2024, formally confirming the group's IRGC affiliation. The Soldiers of Solomon persona is used for some public-facing claims related to the same cluster's operations.