The group known as CyberAv3ngers has, in the last year and a half, proven to be the Iranian government's most active hackers focused on industrial control systems. Its targets include water, wastewater, oil and gas, and many other types of critical infrastructure.
CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide
Despite their hacktivist front, CyberAv3ngers is a rare state-sponsored hacker group bent on putting industrial infrastructure at risk—and has already caused global disruption.
www.wired.com
April 14, 2025 at 8:33 PM
The group known as CyberAv3ngers has, in the last year and a half, proven to be the Iranian government's most active hackers focused on industrial control systems. Its targets include water, wastewater, oil and gas, and many other types of critical infrastructure.
Despite their hacktivist front, CyberAv3ngers is a rare state-sponsored hacker group bent on putting industrial infrastructure at risk—and has already caused global disruption. www.wired.com/story/cybera...
CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide
Despite their hacktivist front, CyberAv3ngers is a rare state-sponsored hacker group bent on putting industrial infrastructure at risk—and has already caused global disruption.
www.wired.com
April 14, 2025 at 10:05 AM
Despite their hacktivist front, CyberAv3ngers is a rare state-sponsored hacker group bent on putting industrial infrastructure at risk—and has already caused global disruption. www.wired.com/story/cybera...
First up, the CyberAv3ngers. Despite their hacktivist front, CyberAv3ngers is a rare state-sponsored hacker group bent on putting industrial infrastructure at risk—and has already caused global disruption. wrd.cm/42vRwpF
CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide
Despite their hacktivist front, CyberAv3ngers is a rare state-sponsored hacker group bent on putting industrial infrastructure at risk—and has already caused global disruption.
www.wired.com
April 14, 2025 at 12:01 PM
First up, the CyberAv3ngers. Despite their hacktivist front, CyberAv3ngers is a rare state-sponsored hacker group bent on putting industrial infrastructure at risk—and has already caused global disruption. wrd.cm/42vRwpF
This “the extremely cool and very sexy CyberAv3ngers hacking group, of which I am certainly not an active member, has asked me to pass along the following exciting message..” ass post.
August 2, 2026 at 8:46 AM
This “the extremely cool and very sexy CyberAv3ngers hacking group, of which I am certainly not an active member, has asked me to pass along the following exciting message..” ass post.
No claim of responsibility but many things seem to point to CyberAv3ngers, an Iranian pro-regime hacker group that claim to be hacktivists but are linked by various intel agencies and security vendors directly to the Iranian government.
www.theregister.com/security/202...
www.theregister.com/security/202...
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
More than 30 facilities disrupted in 'coordinated cyberattack,' though officials have yet to name a culprit
www.theregister.com
July 29, 2026 at 2:27 PM
No claim of responsibility but many things seem to point to CyberAv3ngers, an Iranian pro-regime hacker group that claim to be hacktivists but are linked by various intel agencies and security vendors directly to the Iranian government.
www.theregister.com/security/202...
www.theregister.com/security/202...
Cyber threats to critical infrastructure are rising!
Join Casey Brooks & Kyle O'Meara at #CYBERWARCON to explore tactics by CyberArmyofRussia_Reborn, CyberAv3ngers, and VOLTIZITE targeting water, energy, and telecom.
Don’t miss this ICS & OT security talk!💡
🎟️ www.cyberwarcon.com/registration
Join Casey Brooks & Kyle O'Meara at #CYBERWARCON to explore tactics by CyberArmyofRussia_Reborn, CyberAv3ngers, and VOLTIZITE targeting water, energy, and telecom.
Don’t miss this ICS & OT security talk!💡
🎟️ www.cyberwarcon.com/registration
November 18, 2024 at 10:43 PM
Cyber threats to critical infrastructure are rising!
Join Casey Brooks & Kyle O'Meara at #CYBERWARCON to explore tactics by CyberArmyofRussia_Reborn, CyberAv3ngers, and VOLTIZITE targeting water, energy, and telecom.
Don’t miss this ICS & OT security talk!💡
🎟️ www.cyberwarcon.com/registration
Join Casey Brooks & Kyle O'Meara at #CYBERWARCON to explore tactics by CyberArmyofRussia_Reborn, CyberAv3ngers, and VOLTIZITE targeting water, energy, and telecom.
Don’t miss this ICS & OT security talk!💡
🎟️ www.cyberwarcon.com/registration
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
www.theregister.com
July 29, 2026 at 2:13 PM
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
CISA: IR-linked TA's are uploading malicious project files to PLCs!
Industry & media: zzzzzzzzz
Me:
www.dataminr.com/resources/bl...
Industry & media: zzzzzzzzz
Me:
www.dataminr.com/resources/bl...
Implications of Recent CISA Disclosures on Iranian OT Targeting
CyberAv3ngers (IRGC CEC) expands OT attacks from Rockwell PLCs to Schneider Electric and Siemens devices, manipulating safety-critical logic.
www.dataminr.com
July 27, 2026 at 9:33 PM
CISA: IR-linked TA's are uploading malicious project files to PLCs!
Industry & media: zzzzzzzzz
Me:
www.dataminr.com/resources/bl...
Industry & media: zzzzzzzzz
Me:
www.dataminr.com/resources/bl...
Security researchers at Tenable suspect the Iran linked faux hacktivist outfit CyberAv3ngers was behind the cyberattack that disrupted 30+ Minnesota water facilities.
Tenable notes the pattern is consistent with the crew's previous raids. The timing is relative to recent government warnings
Tenable notes the pattern is consistent with the crew's previous raids. The timing is relative to recent government warnings
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
More than 30 facilities disrupted in 'coordinated cyberattack,' though officials have yet to name a culprit
share.google
July 30, 2026 at 4:56 PM
Security researchers at Tenable suspect the Iran linked faux hacktivist outfit CyberAv3ngers was behind the cyberattack that disrupted 30+ Minnesota water facilities.
Tenable notes the pattern is consistent with the crew's previous raids. The timing is relative to recent government warnings
Tenable notes the pattern is consistent with the crew's previous raids. The timing is relative to recent government warnings
Els ciberexèrcit iranià el conformen:
Handala (que Washington atribueix al Ministeri d'Intel·ligència), Ababil of Minab, APTIRAN (vinculat als Guardians de la Revolució), CyberAv3ngers. Estructura internacional.
Handala (que Washington atribueix al Ministeri d'Intel·ligència), Ababil of Minab, APTIRAN (vinculat als Guardians de la Revolució), CyberAv3ngers. Estructura internacional.
September 20, 2026 at 7:59 PM
Els ciberexèrcit iranià el conformen:
Handala (que Washington atribueix al Ministeri d'Intel·ligència), Ababil of Minab, APTIRAN (vinculat als Guardians de la Revolució), CyberAv3ngers. Estructura internacional.
Handala (que Washington atribueix al Ministeri d'Intel·ligència), Ababil of Minab, APTIRAN (vinculat als Guardians de la Revolució), CyberAv3ngers. Estructura internacional.
Selon Nozomi Networks, spécialisée dans la sécurisation des technologies opérationnelles (OT) pour les infrastructures critiques, les pirates informatiques soutenus par l'État iranien semblent avoir intensifié leurs attaques contre les industries américaines au cours des deux derniers mois.
Threat Actor Activity Related to the Iran Conflict
Nozomi Networks Labs has observed a 133% increase in cyberattacks coming from well-known Iranian threat actors including MuddyWater, APT33, OilRig, CyberAv3ngers.
www.nozominetworks.com
July 14, 2025 at 3:45 AM
Selon Nozomi Networks, spécialisée dans la sécurisation des technologies opérationnelles (OT) pour les infrastructures critiques, les pirates informatiques soutenus par l'État iranien semblent avoir intensifié leurs attaques contre les industries américaines au cours des deux derniers mois.
CyberAv3ngers posted “Stay tuned” on July 21. CISA warning dropped July 22
July 31, 2026 at 8:32 PM
CyberAv3ngers posted “Stay tuned” on July 21. CISA warning dropped July 22
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
More than 30 facilities disrupted in 'coordinated cyberattack,' though officials have yet to name a culprit
www.theregister.com
July 29, 2026 at 1:50 PM
Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
Iranian hackers, CyberAv3ngers, target critical infrastructure (water, gas, oil). Masquerading as hacktivists, their escalating attacks (IOControl malware) earned a $10M US bounty.#CyberAv3ngersThreat
April 14, 2025 at 2:02 PM
Iranian hackers, CyberAv3ngers, target critical infrastructure (water, gas, oil). Masquerading as hacktivists, their escalating attacks (IOControl malware) earned a $10M US bounty.#CyberAv3ngersThreat
-Claroty has linked the malware to Iranian group CyberAv3ngers (IRGC-CEC)
-can infect PLCs, HMIs, firewalls, routers, and IP cameras
-confirmed infections of Gasboy/ORPAK devices
-IOTCONTROL communicates with a C2 over a secure MQTT channel
-can infect PLCs, HMIs, firewalls, routers, and IP cameras
-confirmed infections of Gasboy/ORPAK devices
-IOTCONTROL communicates with a C2 over a secure MQTT channel
December 10, 2024 at 7:56 PM
-Claroty has linked the malware to Iranian group CyberAv3ngers (IRGC-CEC)
-can infect PLCs, HMIs, firewalls, routers, and IP cameras
-confirmed infections of Gasboy/ORPAK devices
-IOTCONTROL communicates with a C2 over a secure MQTT channel
-can infect PLCs, HMIs, firewalls, routers, and IP cameras
-confirmed infections of Gasboy/ORPAK devices
-IOTCONTROL communicates with a C2 over a secure MQTT channel
Niente esplosioni, solo IP cambiati: gli hacker iraniani di CyberAv3ngers dietro il blackout di una centrale elettrica britannica
il blog: insicurezzadigitale.com/niente-esplo...
#cybersecurity #cyberav3ngers #cyberwar #icsscada #infosec #infrastrutturecritiche #iran #irgc #regnounito
il blog: insicurezzadigitale.com/niente-esplo...
#cybersecurity #cyberav3ngers #cyberwar #icsscada #infosec #infrastrutturecritiche #iran #irgc #regnounito
August 26, 2026 at 7:28 AM
Niente esplosioni, solo IP cambiati: gli hacker iraniani di CyberAv3ngers dietro il blackout di una centrale elettrica britannica
il blog: insicurezzadigitale.com/niente-esplo...
#cybersecurity #cyberav3ngers #cyberwar #icsscada #infosec #infrastrutturecritiche #iran #irgc #regnounito
il blog: insicurezzadigitale.com/niente-esplo...
#cybersecurity #cyberav3ngers #cyberwar #icsscada #infosec #infrastrutturecritiche #iran #irgc #regnounito
“The hacktivists, CyberAv3ngers…”
a man is playing drums on a stage with the words `` and i ran i ran so far away '' .
ALT: a man is playing drums on a stage with the words `` and i ran i ran so far away '' .
media.tenor.com
August 4, 2025 at 7:00 PM
“The hacktivists, CyberAv3ngers…”
How Iranian and Israeli hacking groups spent years sparring online; the US State Department is offering $10M for info on the Iran-linked CyberAv3ngers group (Jordan Robertson/Bloomberg)
Main Link | Techmeme Permalink
Main Link | Techmeme Permalink
June 19, 2025 at 10:05 AM
How Iranian and Israeli hacking groups spent years sparring online; the US State Department is offering $10M for info on the Iran-linked CyberAv3ngers group (Jordan Robertson/Bloomberg)
Main Link | Techmeme Permalink
Main Link | Techmeme Permalink
Iran (linked? Backed?) focused hacktivist group (persona?) “APT Iran” claim this video is of a breach of PLC interface at water utility in Texas. Interesting to note that they have added attribution to CyberAv3ngers in the video, APT Iran is thought by many to be a semi-rebrand of that other group.
September 9, 2026 at 2:02 PM
Iran (linked? Backed?) focused hacktivist group (persona?) “APT Iran” claim this video is of a breach of PLC interface at water utility in Texas. Interesting to note that they have added attribution to CyberAv3ngers in the video, APT Iran is thought by many to be a semi-rebrand of that other group.
-DPRK targets Polymarket bot devs
-Contagious Interview hits Reddit
-New Kimsuky C2 leak
-CyberAv3ngers and APT35 profiles
-Adobe patches Reader zero-day
-Marimo bug exploited in the wild
-MAX riddled with bugs
-Samsung paid $940k to researchers
-Fiber optics can be used as a microphone
-Contagious Interview hits Reddit
-New Kimsuky C2 leak
-CyberAv3ngers and APT35 profiles
-Adobe patches Reader zero-day
-Marimo bug exploited in the wild
-MAX riddled with bugs
-Samsung paid $940k to researchers
-Fiber optics can be used as a microphone
April 13, 2026 at 9:39 AM
-DPRK targets Polymarket bot devs
-Contagious Interview hits Reddit
-New Kimsuky C2 leak
-CyberAv3ngers and APT35 profiles
-Adobe patches Reader zero-day
-Marimo bug exploited in the wild
-MAX riddled with bugs
-Samsung paid $940k to researchers
-Fiber optics can be used as a microphone
-Contagious Interview hits Reddit
-New Kimsuky C2 leak
-CyberAv3ngers and APT35 profiles
-Adobe patches Reader zero-day
-Marimo bug exploited in the wild
-MAX riddled with bugs
-Samsung paid $940k to researchers
-Fiber optics can be used as a microphone
New @wired.com as @agreenberg.bsky.social tackles a threat & two sectors _very_ near & dear to my 🖤 'CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide' 🇮🇷 www.wired.com/story/cybera... cc @gate15.bsky.social @craignewmark.bsky.social #water #cybersecurity #gas #Iran
CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide
Despite their hacktivist front, CyberAv3ngers is a rare state-sponsored hacker group bent on putting industrial infrastructure at risk—and has already caused global disruption.
www.wired.com
April 14, 2025 at 10:41 AM
New @wired.com as @agreenberg.bsky.social tackles a threat & two sectors _very_ near & dear to my 🖤 'CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide' 🇮🇷 www.wired.com/story/cybera... cc @gate15.bsky.social @craignewmark.bsky.social #water #cybersecurity #gas #Iran
skirmishes, website defacements and leaking of databases.
What does all this amount to? A lot of background noise, a lot of packets and credentials slung around & some new alliances.
Of the most interest to me are the alleged Iranian proxy groups like Handala or CyberAv3ngers, among others.
What does all this amount to? A lot of background noise, a lot of packets and credentials slung around & some new alliances.
Of the most interest to me are the alleged Iranian proxy groups like Handala or CyberAv3ngers, among others.
March 9, 2026 at 5:49 PM
skirmishes, website defacements and leaking of databases.
What does all this amount to? A lot of background noise, a lot of packets and credentials slung around & some new alliances.
Of the most interest to me are the alleged Iranian proxy groups like Handala or CyberAv3ngers, among others.
What does all this amount to? A lot of background noise, a lot of packets and credentials slung around & some new alliances.
Of the most interest to me are the alleged Iranian proxy groups like Handala or CyberAv3ngers, among others.
When there’s a ten million dollar reward for information about you and you are using gmail as your email contact.
June 17, 2025 at 12:42 PM
When there’s a ten million dollar reward for information about you and you are using gmail as your email contact.