- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored, Islamic Revolutionary Guard Corps (IRGC)
- Agency named
- IRGC, Islamic Revolutionary Guard Corps, NSA
- Motivation
- Sabotage and destruction
- Seen
- 2019–2026
- Status
- Active
- ATT&CK
- G1027 · 17 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0120 · cyberav3ngers
What it is
The CyberAv3ngers are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The CyberAv3ngers have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.
In 2023, the CyberAv3ngers engaged in a global targeting and hacking of the Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Cyber Av3ngers, Shahid Kaveh Group, Soldiers of Soloman
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Ireland, Israel, United States
- Sectors
- Industrial
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de