MITRE ATT&CKgroup
G1027 CyberAv3ngers
- Domain
- ics
- Aliases
- Soldiers of Soloman
- Version
- 1.1
- Created
- 2024-03-25
Description
The CyberAv3ngers are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The CyberAv3ngers have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.
In 2023, the CyberAv3ngers engaged in a global targeting and hacking of the Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface.
Related
Uses · MITRE ATT&CK (17)
- T1692.001 Command Message sub-technique
- T1694.001 Default Credentials sub-technique
- T1695 Block Communications technique
- T0892 Change Credential technique
- T0889 Modify Program technique
- T0886 Remote Services technique
- T0826 Loss of Availability technique
- T0827 Loss of Control technique
- T0829 Loss of View technique
- T0838 Modify Alarm Settings technique
- T0843 Program Download technique
- T0845 Program Upload technique
- T0871 Execution through API technique
- T0879 Damage to Property technique
- T0880 Loss of Safety technique
- T0883 Internet Accessible Device technique
- T0885 Commonly Used Port technique
Referenced by MITRE ATT&CK · attributed to (1)
- C0031 Unitronics Defacement Campaign campaign
References
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a CISA AA23-335A IRGC-Affiliated December 2023