U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks)
Key Facts
- Legal Status: FUGITIVE in U.S. District Court for the Western District of Pennsylvania.
- Primary Target Sector: Water and Wastewater Systems, Energy.
- Documented Financial Loss: $15.0 million.
- 2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Incident Overview
Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.
Root Cause & Infiltration Vector
Initial access established against Water and Wastewater Systems, Energy infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.
Operational Impact & Financial Blast Radius
Resulted in $15,000,000 in documented financial liabilities. Forced manual pump operations at multiple municipal water authorities across Pennsylvania and New Jersey.
Executive Risk Checklist
- 1. Are 100% of external and administrative access portals protected by phishing-resistant MFA?
- 2. Is network microsegmentation enforced between user workstations and core database enclaves?
- 3. Have immutable offline backups and incident escalation procedures been validated within 90 days?
Incident Execution & Kill-Chain Lifecycle
Sequential reconstruction of intrusion stages from initial infiltration to resolution.
Defendants gained access to internet-connected Unitronics Vision PLCs because the industrial devices remained configured with the default manufacturer password '1111'.
Attackers defaced screen displays on industrial pressure monitoring stations with anti-Israel political slogans and halted remote pump regulation.
Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Water and Wastewater Systems, Energy infrastructure.
Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.
Standard of Care Remediation & Hardening
Empirical engineering takeaways and preventative controls derived from this incident.
Procedural & Incident Timeline
CISA publishes alert on exploitation of Unitronics PLCs used in water systems.
Treasury OFAC sanctions officials of the IRGC Cyber-Electronic Command.
Unsealing of criminal indictment against six Iranian military cyber actors.
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1078 | Valid Accounts Defense Evasion | "Defendants gained access to internet-connected Unitronics Vision PLCs because the industrial devices remained configured with the default manufacturer password '1111'." | CISA Advisory AA23-335A ¶ 4 | reviewed |
| T1485 | Data Destruction Impact | "Attackers defaced screen displays on industrial pressure monitoring stations with anti-Israel political slogans and halted remote pump regulation." | Indictment ¶ 18, Page 9 | reviewed |