Iran-Linked CyberAv3ngers Sets Sights on Water Utilities and Industrial Controllers

The article highlights the activities of a cyber threat group linked to Iran, known as "CyberAv3ngers," which has targeted water utilities and industrial controllers. Here are the key points:

1. Targeted Industries: The group's recent attacks have focused on water utilities and industrial control systems (ICS) in North America.

2. Malware Variants:

   • WastedLocker: A ransomware variant that encrypts files.
   • BazarBackdoor: An implant used for initial access and lateral movement within networks.
   • IOCAgent: A malware designed to gather information from ICS devices, particularly those manufactured by Rockwell Automation.

3. Vulnerability Exploitation:

   • The group exploits a known vulnerability (CVE-2021-22681) in Rockwell Automation's Logix and Unitronics PLCs.
   • This vulnerability allows attackers to remotely execute code on affected devices.

4. Techniques Used:

   • MQTT over TLS: IOCAgent uses this protocol on port 8883 to communicate with command-and-control servers, blending in with normal IoT traffic.
   • **DNS-over-HTTPS (

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.