G1027: CyberAv3ngers
The CyberAv3ngers are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The CyberAv3ngers have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.[1]
In 2023, the CyberAv3ngers engaged in a global targeting and hacking of the Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface.[1]
Security context for executives and security teams
G1027: CyberAv3ngers describes The [CyberAv3ngers](https://attack.mitre.org/groups/G1027) are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The [CyberAv3ngers](https://attack.mitre.org/groups/G1027) have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.(Citation: CISA AA23-335A IRGC-Affiliated December 2023) In 2023, the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) engaged in a global targeting and hacking of the ...
Executive priority
G1027: CyberAv3ngers is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate G1027: CyberAv3ngers by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether G1027: CyberAv3ngers appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
CyberAv3ngers
The CyberAv3ngers are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The CyberAv3ngers have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.[1]
In 2023, the CyberAv3ngers engaged in a global targeting and hacking of the Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| ICS | T0883 | Internet Accessible Device | During the 2026 Iranian Water Campaign, CyberAv3ngers accessed internet accessible PLCs that were exposed through cellular gateways across multiple vendors including Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens.CitationCISA-AA26-097A |
| ICS | T0871 | Execution through API | During the 2026 Iranian Water Campaign, CyberAv3ngers leveraged existing PLC management protocols through the manufacturer’s engineering tools. These include EtherNet/IP CIP, S7Comm, and UMAS.CitationCISA-AA26-097A |
| ICS | T0838 | Modify Alarm Settings | During the 2026 Iranian Water Campaign, CyberAv3ngers manipulated critical shutdown and alarm logic.CitationCISA-AA26-097A |
| ICS | T0843 | Program Download | During the 2026 Iranian Water Campaign, CyberAv3ngers used the manufacturers’ commercial PLC programming software to push new configurations to victim hardware. These include Rockwell Automation’s Studio Logix 5000 Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal. In these changes, adversaries deleted program logic, removed Add-On Instructions (AOIs) and manipulated alarm logic and HMI screens.CitationCISA-AA26-097A |
| ICS | T0879 | Damage to Property | During the 2026 Iranian Water Campaign, CyberAv3ngers disrupted water operations that have included loss of water pressure and flooding.CitationTenable Minnesota Water Utilities |
| ICS | T0829 | Loss of View | During the 2026 Iranian Water Campaign, CyberAv3ngers manipulated process logic, HMI, and SCADA displays, which may disrupt operators view of the system.CitationCISA-AA26-097A |
| ICS | T1694.001 | Default CredentialsSub-technique | During the 2026 Iranian Water Campaign, CyberAv3ngers accessed internet-accessible equipment using default credentials.CitationTenable Minnesota Water UtilitiesCitationDispel Iran Water Utilities |
| ICS | T0826 | Loss of Availability | During the 2026 Iranian Water Campaign, CyberAv3ngers degraded operations across at least seven states that resulted in reported incidents, pressure loss and flooding.CitationTenable Minnesota Water Utilities |
| ICS | T0880 | Loss of Safety | During the 2026 Iranian Water Campaign, CyberAv3ngers manipulated critical shutdown and alarm logic, which would allow the system to enter unsafe process states without proper notification or protections.CitationCISA-AA26-097A |
| ICS | T1695 | Block Communications | During the 2026 Iranian Water Campaign, CyberAv3ngers locked out operators by changing the PLC’s IP address.CitationTenable Minnesota Water Utilities |
| ICS | T0827 | Loss of Control | During the 2026 Iranian Water Campaign, CyberAv3ngers manipulated process logic, HMI, and SCADA displays. In addition to this, adversaries locked victims out by changing the PLCs management passwords.CitationCISA-AA26-097A |
| ICS | T1692.001 | Command MessageSub-technique | During the 2026 Iranian Water Campaign, CyberAv3ngers used the manufacturers’ commercial PLC programming and maintenance software to send unauthorized command messages to multiple victim controllers. These include Rockwell Automation’s Studio Logix 5000 Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal .CitationCISA-AA26-097A |
| ICS | T0845 | Program Upload | During the 2026 Iranian Water Campaign, CyberAv3ngers used the program upload feature to exfiltrate project files from victim PLCs. CitationCISA-AA26-097A |
| ICS | T0885 | Commonly Used Port | During the 2026 Iranian Water Campaign, CyberAv3ngers were observed using secure shell ports TCP/22 and common industrial ports (TCP/44818, TCP&UDP/2222, TCP/102, and TCP/502). CitationCISA-AA26-097A |
| ICS | T0889 | Modify Program | During the 2026 Iranian Water Campaign, CyberAv3ngers used manufacturers’ commercial PLC programming software to modify their victim’s running PLC program logic. These include Rockwell Automation’s Studio Logix 5000 Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal.CitationCISA-AA26-097A |
| ICS | T0892 | Change Credential | During the 2026 Iranian Water Campaign, CyberAv3ngers locked out operators by changing the PLCs passwords and IP addresses.CitationTenable Minnesota Water Utilities |
| ICS | T0886 | Remote Services | During the 2026 Iranian Water Campaign, one victim reported actors leveraged Dropbear Secure Shell (SSH) software to enable remote access over port 22.CitationCISA-AA26-097A |
Groups, software, and campaigns
C0031: Unitronics Defacement Campaign
The Unitronics Defacement Campaign was a collection of intrusions across multiple sectors by the CyberAv3ngers, where threat actors engaged in a seemingly opportunistic and global targeting and defacement of Unitronics Vision Series Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). The sectors that these PLCs can be commonly found in are water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the PLCs' HMIs.[1][2]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.1 | Current bundle | b27386f627c5… | ||
| 19.2 | 1.0 | Older bundle | d3788a61dc33… | ||
| 19.1 | 1.0 | Older bundle | a75a88e75f7b… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]CISA AA23-335A IRGC-Affiliated December 2023
DHS/CISA. (2023, December 1). IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. Retrieved March 25, 2024.
Open source URL - [2]Soldiers of Soloman
CyberAv3ngers reportedly has connections to the IRGC-linked group Soldiers of Solomon.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)
- [3]mitre-attackG1027Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.