Iranian-Linked Cyber Av3ngers Campaign Targeting Unitronics PLCs
IRGC-linked threat actor "Cyber Av3ngers" is targeting U.S. critical infrastructure by exploiting internet-exposed Unitronics Programmable Logic Controllers (PLCs). Attackers leverage default credentials and exposed web interfaces to manipulate PLC logic and disrupt industrial control protocols, specifically targeting the water and wastewater sectors across 12 states. Impact includes operational downtime of up to 12 hours in municipalities such as Cape May and Childersburg. The campaign signals a shift toward kinetic operational disruption via the manipulation of Modbus and proprietary Unitronics communication patterns, requiring immediate remediation of internet-facing OT assets.
Coordinated Attack on Minnesota Water Infrastructure Targeting Rockwell Automation and Schneider Electric PLCs
A coordinated cyberattack targeted over 30 Minnesota water and wastewater utilities, leveraging internet-exposed industrial control systems (ICS) via cellular modems. The campaign utilized critical vulnerabilities in Rockwell Automation controllers (CVE-2021-22681, CVE-2023-3595, CVE-2024-6242) and targeted Schneider Electric and Siemens PLCs. Threat actors, attributed to the Iranian-linked CyberAv3ngers (IRGC-CEC), progressed to "Phase 4" capabilities, employing legitimate vendor engineering software to exfiltrate PLC project files and manipulate Add-On Instructions (AOIs) to disable safety protocols. This resulted in operational shutdowns in Braham and transitions to manual operations across multiple municipalities, though no water quality contamination was reported.
CyberAv3ngers Target Unitronics, Federal Signal, and Genmark Siren Controllers in Psychological Warfare Campaign
The IRGC-linked threat actor CyberAv3ngers is executing a targeted campaign against critical infrastructure, specifically exploiting internet-facing Unitronics Vision PLCs, Federal Signal, and Genmark siren controllers. By leveraging weak or default credentials and unauthorized access to Human-Machine Interfaces (HMIs), the group manipulates emergency alert protocols and public warning systems. This shift from technical sabotage to "cyber-psychological warfare" aims to trigger mass public panic and erode societal trust in civil safety mechanisms. The campaign serves as a non-kinetic extension of regional geopolitical tensions, requiring urgent hardening of OT network segmentation and credential management to prevent mass societal destabilization.