CISA, FBI & NSA ADVISORY
AA23-335A: IRGC-Affiliated Cyber Actors Exploit Unitronics PLCs in Water and Wastewater Systems
Key Facts
- Official advisory designation: AA23-335A.
- Published on 2023-12-01 by CISA, FBI & NSA.
- Directly correlated with 1 primary case dossier(s) in this library.
- Provides joint government TTPs, MITRE ATT&CK indicators, and prioritized enterprise mitigations.
Related Primary Court Cases & Incident Forensics
U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks)
fugitive 2024-09-24
Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.
Infiltration Vector: Initial access established against Water and Wastewater Systems, Energy infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.
2 techniques mapped · Loss: $15.0 million
View full case dossier →
ATT&CK Techniques Cited in Advisory Matters
T1078: Valid Accounts
"Defendants gained access to internet-connected Unitronics Vision PLCs because the industrial devices remained configured with the default manufacturer password '1111'."
T1485: Data Destruction
"Attackers defaced screen displays on industrial pressure monitoring stations with anti-Israel political slogans and halted remote pump regulation."