The article highlights the activities of a cyber threat group linked to Iran, known as "CyberAv3ngers," which has targeted water utilities and industrial controllers. Here are the key points:
-
Targeted Industries: The group's recent attacks have focused on water utilities and industrial control systems (ICS) in North America.
-
Malware Variants:
- WastedLocker: A ransomware variant that encrypts files.
- BazarBackdoor: An implant used for initial access and lateral movement within networks.
- IOCAgent: A malware designed to gather information from ICS devices, particularly those manufactured by Rockwell Automation.
-
Vulnerability Exploitation:
- The group exploits a known vulnerability (CVE-2021-22681) in Rockwell Automation's Logix and Unitronics PLCs.
- This vulnerability allows attackers to remotely execute code on affected devices.
-
Techniques Used:
- MQTT over TLS: IOCAgent uses this protocol on port 8883 to communicate with command-and-control servers, blending in with normal IoT traffic.
- **DNS-over-HTTPS (
Read the full article at Cyber Security News
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)



