Threats Feed

Iranian-affiliated APT actors are actively exploiting internet-facing operational technology (OT) devices, specifically Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs), across U.S. critical infrastructure. Targeting the Government Services and Facilities, Water and Wastewater Systems (WWS), and Energy sectors, these threat actors utilize leased infrastructure, Studio 5000 Logix Designer, and Dropbear SSH to establish unauthorized remote access. By maliciously interacting with extracted project files and manipulating data on HMI and SCADA displays, the attackers have successfully caused operational disruptions and tangible financial losses. Defenders must urgently secure vulnerable ports and monitor for associated indicators of compromise.

Team82's research details the IOCONTROL malware, a custom-built cyberweapon used by Iran-linked attackers, specifically the CyberAv3ngers group. The malware targets a range of industrial control systems (ICS) and Internet of Things (IoT) devices, notably impacting fuel management systems in Israel and the US. IOCONTROL's functionality includes communication via the MQTT protocol and features such as arbitrary code execution and self-deletion. The analysis reveals the malware's infrastructure, including its command-and-control server and the methods used to evade detection. The report concludes that IOCONTROL represents a significant threat to critical infrastructure, highlighting the ongoing geopolitical conflict.