CyberAv3ngers Targeting Industrial Control Systems

CyberAv3ngers, an IRGC-affiliated threat actor, targeted and compromised Unitronics Vision Series programmable logic controllers (PLCs) and human machine interfaces (HMIs). These devices are commonly used in the Water and Wastewater Systems (WWS) and other industrial environments. Between November 2023 and January 2024, CyberAv3ngers targeted Unitronics PLC devices used in multiple critical infrastructure industries. The actors compromised multiple Unitronics Vision Series devices by authenticating to internet-connected devices with communications set to the default TCP port 20256. These devices either had a default password in place or no password.