CyberAv3ngers
Assessed with high confidence (per CISA advisory AA26-097A update) to be affiliated with Iran's IRGC Cyber Electronic Command (IRGC-CEC), operating under the Shahid Kaveh Group; tracked under overlapping vendor names — Dragos: BAUXITE; Microsoft: Storm-0784; Mandiant: UNC5691. Confidence in this attribution is high for the broader PLC-targeting pattern documented in AA26-097A; for the specific July 2026 Minnesota attacks, contemporaneous reporting described the link as 'suspected'/unconfirmed, based on matching tactics and infrastructure rather than confirmed attribution — treat the Minnesota incident's attribution as somewhat lower-confidence than the group's documented pattern overall. · Access and capability development across critical infrastructure (water, energy, government) and disruption of OT with apparent geopolitical signaling intent — disabling alarm/emergency shutdown logic and locking out operators creates conditions where physical damage is possible, consistent with prior hacktivist-persona water-sector operations
Tactics, Techniques & Procedures (TTPs)
- Scans for internet-exposed PLCs via standard industrial protocol ports: EtherNet/IP (44818), Modbus (502), Siemens ISO-TSAP (102), SSH (22), and Shodan-style internet-wide scanning
- Uses engineering workstation software (Studio 5000 Logix Designer, TIA Portal, EcoStruxure) to authenticate directly to PLCs and upload modified project files
- Disables alarm and emergency shutdown logic before exfiltrating original project files for intelligence collection
- Compromised at least 75 Unitronics Vision Series PLCs (US, Israel, UK, Ireland) by exploiting default credentials never changed post-deployment
- Exploits CVE-2021-22681 (insufficiently protected cryptographic key in Rockwell Studio 5000 Logix Designer), an unpatchable flaw, in Rockwell/Allen-Bradley environments
- Changed device credentials and network/IP configurations to lock out legitimate operators, forcing manual operations
- Maintains persistence via Dropbear SSH, a lightweight embedded-systems SSH daemon unlikely to trigger OT-environment alerts
- Historical pattern: locate internet-facing PLCs, exploit default credentials or known remote-access vulnerabilities, alter configuration to block legitimate access, then claim/publicize disruption
Known Targets
Analyst Notes
The July 22 AA26-097A expansion (to Schneider Electric and Siemens, beyond the original Rockwell-only scope) was issued four days before the Minnesota attacks, without a corresponding public incident at the time — suggesting ongoing sector information-sharing rather than a reaction to Minnesota specifically. The FBI separately confirmed water systems in seven states (not just Minnesota) were targeted in the same window. Maple Plain's mayor declared a local state of emergency; Minnesota IT Services (MNIT) led containment. Possible coordination with Handala (a separate Iran-affiliated, MOIS-attributed persona that declared US water/electricity/transportation priority targets three days before the Minnesota attacks, and separately claimed Maryland OT and California Water Service breaches) is explicitly unconfirmed — may be parallel campaigns by distinct Iranian units rather than a joint operation. Formerly tracked on this site under three separate profile variants ('CyberAv3ngers (IRGC)', 'CyberAv3ngers (Shahid Kaveh Group)', 'CyberAv3ngers (suspected)') reflecting differing per-article confidence framing of the same underlying actor; consolidated here into one profile with the confidence nuance preserved above.
Also Known As
Intelligence Reports
Coordinated OT Attack Disrupts 30+ Minnesota Water Utilities in Suspected Iranian PLC Campaign
A coordinated cyberattack on July 26-27 targeted operational technology at more than 30 Minnesota municipal water systems, exploiting internet-facing PLCs to lock out operators and disrupt service. Iranian-linked threat activity is suspected, mirroring CyberAv3ngers tactics.
CISA Expands Iranian PLC Attack Advisory to Schneider Electric and Siemens
CISA updated advisory AA26-097A on July 22 to expand the scope of confirmed Iranian-affiliated OT intrusions beyond Rockwell Automation PLCs to include Schneider Electric and Siemens devices across US critical infrastructure.