Cyber Av3ngers

THREAT ACTOR PROFILE

Cyber Av3ngers

Cyber Av3ngers is an Iranian group, linked to the IRGC Cyber-Electronic Command, that targets operational technology at water, energy and other critical-infrastructure organizations. It gained attention for compromising internet-exposed programmable logic controllers (PLCs) and human-machine interfaces, defacing devices and, in later activity, manipulating control systems to cause real disruption.

Country:

Iran

Critical infrastructure / OT

First seen

2023

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

The Cyber Av3ngers persona

Cyber Av3ngers is tracked under its own name and spelling variants. It maps to one entry among the Iran-linked threat actors we profile, and its state-aligned targeting overlaps with other Iranian crews like OilRig.

GROUP PROFILE

OT-focused attacks on critical infrastructure

Cyber Av3ngers is a state-aligned actor built for impact on physical systems. Rather than data theft, its operations target the controllers and interfaces that run water, energy and manufacturing processes, using exposure and weak access controls to reach them.

Our record places its origin as Iran and ties it to attacks on critical infrastructure and OT. US agencies issued advisories after Iranian-affiliated actors breached internet-exposed PLCs from vendors like Rockwell, Schneider and Siemens and manipulated HMI and SCADA displays.

The group's tradecraft centers on finding exposed OT devices, abusing default or weak credentials and configuration tools like Studio 5000, deploying the IOCONTROL Linux backdoor, and using Dropbear SSH for access.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Exposed PLCs into control-system manipulation

The stages below come from Cyber Av3ngers activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

IOCONTROL and OT-focused tooling

Initial Access

CVES EXPLOITED

Exposure and weak credentials over CVE exploitation

Cyber Av3ngers mainly reaches OT through internet exposure, default or weak credentials and legitimate configuration tools rather than a broad CVE arsenal. One flaw tied to the activity in our records is CVE-2021-22681 (Rockwell Studio 5000 Logix Designer). Detection should focus on exposed PLCs and HMIs, anomalous use of configuration software, and the IOCONTROL backdoor and Dropbear SSH.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

PLC exploitation and SCADA manipulation

Recent reporting tracks the group's OT operations.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through