GINC-APT-0120 · State

CyberAv3ngers

Also Cyber Av3ngers, Shahid Kaveh Group, Soldiers of Soloman.

Category
State · Attributed to a state or working for one.
Origin
Iran(high confidence)
Sponsor
State-sponsored, Islamic Revolutionary Guard Corps (IRGC)
Agency named
IRGC, Islamic Revolutionary Guard Corps, NSA
Motivation
Sabotage and destruction
Seen
2019–2026
Status
Active
ATT&CK
G1027 · 17 techniques
Sources
8 sources carry it
Identifier
GINC-APT-0120 · cyberav3ngers

What it is

The CyberAv3ngers are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The CyberAv3ngers have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.

In 2023, the CyberAv3ngers engaged in a global targeting and hacking of the Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Other names
Cyber Av3ngers, Shahid Kaveh Group, Soldiers of Soloman

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Targets

Countries
Ireland, Israel, United States
Sectors
Industrial

Tools

The tools and malware families the sources tie to it.

  • Cyber Eye RAT
  • CyberGate

Sources