PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-11-12
Data as of November 12, 2026 at 05:15 UTC
Search
MITRE ATT&CK G1028

IRGC Cyber-Electronic Command

View MITRE Group Page ↗
Aliases: CyberAv3ngers, Shahid Shoushtari, Cotton Sandstorm
Official Attribution Source: U.S. Department of Justice (W.D. Pa.) & CISA Advisory AA23-335A

Key Facts

Jurisdiction
Islamic Republic of Iran
Geographic origin
Cases
1
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
0
OFAC designations
  • Attributed Country: Islamic Republic of Iran.
  • ATT&CK Group Reference: G1028 (IRGC Cyber-Electronic Command).
  • Linked to 1 primary court prosecution record(s) with $15.0 million documented loss.
  • Identified 0 individually charged operative(s) and 0 OFAC designation(s).

Primary ATT&CK Techniques Employed

ATT&CK Techniques Mapped to IRGC Cyber-Electronic Command Technique frequencies extracted from verified indictments for IRGC Cyber-Electronic Command. T1078 Valid Accounts 1 incidents T1485 Data Destruction 1 incidents
Technique frequencies extracted from verified indictments for IRGC Cyber-Electronic Command.
ATT&CK Techniques Mapped to IRGC Cyber-Electronic Command
Technique Frequency
T1078 Valid Accounts 1 incidents
T1485 Data Destruction 1 incidents

Prosecution Cases Attributed to IRGC Cyber-Electronic Command

U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks)

fugitive 2024-09-24

Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.

Primary Attack Mechanism: Initial access established against Water and Wastewater Systems, Energy infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.
2 techniques mapped · Loss: $15.0 million View full case dossier →

Documented TTP Signature for IRGC Cyber-Electronic Command

Test Controls in Stack Audit →
T1078: Valid Accounts

Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.
T1485: Data Destruction

Adversaries irreversibly overwrite storage media and files to destroy data rather than extort ransoms.