MITRE ATT&CKsoftware (malware)
S9046 IOControl
- Domain
- enterprise, ics
- Version
- 1.0
- Created
- 2026-09-02
Description
IOControl is a malware that targeted Linux ARM-based IoT/OT devices including Hikvision IP cameras, D-Link firewalls and routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel management systems, and Baicells LTE controllers across the United States and Israel. The malware has been attributed to CyberAv3ngers which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).
Related
Uses · MITRE ATT&CK (13)
- T0869.001 DNS sub-technique
- T0869.002 Publish/Subscribe Protocols sub-technique
- T1701.003 Unix Shell sub-technique
- T0846.001 Port Scan sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1070.009 Clear Persistence sub-technique
- T1027.002 Software Packing sub-technique
- T1070.004 File Deletion sub-technique
- T1037.004 RC Scripts sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1033 System Owner/User Discovery technique
- T1082 System Information Discovery technique
- T1124 System Time Discovery technique
References
- https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol Claroty-IOCONTROL
- https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348 Dragos 2025 Year in Review
- https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/ Armis-IOCONTROL