Cyber Av3ngers
Aliases: CyberAv3ngers, Shahid Kaveh Group
- Origin
- IR
- Primary motivation
- sabotage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Last IoC activity
- 2026-06-26 09:02:47
- Profile updated
- 2026-07-07 12:06:58
Targeted industries: energy-and-utilities government-and-public-sector manufacturing
Targeted regions: country_code:il
Context
Cyber Av3ngers is an Iranian IRGC Cyber-Electronic Command-affiliated threat actor that targets internet-exposed operational technology and industrial control systems. Public reporting documents disruptive targeting of Israeli-made Unitronics PLCs and HMIs, broader critical-infrastructure targeting, and use of the IOCONTROL malware against IoT and OT devices.
Reports & references
- claroty.com — Inside A New Ot Iot Cyber Weapon Iocontrol (report)
- cyberwarzone.com — Cyber Av3Ngers Claims Infiltration Of Israeli Water Treatment Stations Amid Ongoing Conflict (report)
- cyberwarzone.com — Hacking Group Cyber Av3Ngers Claims Responsibility For Yavne Power Outages What You Need To Know (report)
- Kaspersky — 110794 (report)
- CISA — Aa23 335A (report)
- CISA — Aa26 097A (report)