Loading story…
CyberAv3ngers compromised a Unitronics PLC/HMI at the Municipal Water Authority of Aliquippa, Pennsylvania, in November 2023, disrupting equipment used to monitor and regulate water pressure and defacing the controller. The utility took the affected system offline and switched to manual operations; officials reported no known risk to drinking water or the water supply. Microsoft subsequently attributed the attack to the Iranian Islamic Revolutionary Guard Corps-affiliated group it tracks as Storm-0784. The attackers apparently selected the Israeli-manufactured equipment because of its origin. Similar attacks targeted Unitronics devices internationally, while Microsoft also observed pro-Russian actors targeting poorly secured water-sector systems.
CISA assessed that weak passwords and direct internet exposure likely enabled access, but neither its initial reporting nor Microsoft’s analysis conclusively established the precise compromise mechanism. CISA warned that actors were probing TCP port 20256 and using PCOM/TCP-specific scripts to identify Unitronics controllers. Unitronics issued a patch addressing the default-password vulnerability CVE-2023-6448; the reporting does not establish that this vulnerability was the attack vector. Operators should remove PLCs from direct internet access, replace default credentials, require MFA for remote access, deploy firewall/VPN controls, segment OT networks, and update PLC/HMI firmware. Backing up controller logic and configurations and preparing manual-operation and recovery procedures can limit disruption if a controller is compromised.
See the actors and campaigns active against you right now.
13 events from the most recent confirmed update back to the earliest known activity.
A CISA advisory described additional water-sector attacks involving pro-Russian actors targeting internet-exposed OT systems with weak passwords.
Pro-Russian hacktivists targeted U.S. water and wastewater systems in early 2024. The attacks involved internet-exposed operational technology systems protected by weak passwords.
Other Unitronics systems were reportedly attacked internationally around the November 2023 Aliquippa incident. Compromised devices displayed a message declaring Israeli-made equipment a CyberAv3ngers target.
A late-November attack on Pennsylvania’s Municipal Water Authority of Aliquippa compromised a Unitronics PLC-HMI and caused a pressure-regulation pump outage. The device displayed CyberAv3ngers branding, and the group claimed responsibility.
Microsoft used internet-device search engines, geographic information, and metadata including the PLC name “Raccoon Primary PLC” to identify a system it assessed was likely the Aliquippa victim. The identification was contextual rather than a conclusively confirmed forensic finding.
The U.S. Department of the Treasury sanctioned officials in the IRGC Cyber-Electronic Command in connection with the Aliquippa attack.
Unitronics issued a patch requiring users to address the default-password issue associated with CVE-2023-6448.
Following the incidents, the Unitronics default-password configuration issue was assigned CVE-2023-6448. The references do not conclusively establish the precise compromise mechanism in the Aliquippa attack.
Full Pint Beer reported on X that its brewery control system suffered a cyberattack. Restoration efforts involved Brewmation and backups, extending the reported impact beyond public infrastructure.
CISA updated its guidance to advise installing the latest Unitronics PLC/HMI versions and referenced Unitronics Cybersecurity Advisory 2023-001.
A joint cybersecurity advisory described IRGC-affiliated actors exploiting PLCs across multiple sectors, including U.S. water and wastewater facilities. Microsoft reports that CISA attributed the Aliquippa attack to IRGC-affiliated CyberAv3ngers.
CISA warned of active exploitation of Unitronics PLCs in the water sector and assessed that weak passwords and internet exposure likely enabled access. The alert urged operators to replace default credentials, restrict remote access, and remove direct internet exposure.
The affected water authority took the compromised system offline and switched to manual operations. The utility and CISA stated that there was no known risk to the drinking water or water supply.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourcesecurityweek.com
Open sourcecisa.gov
Open sourceincibe.es
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cyberattack on the Municipal Water Authority of Aliquippa in Pennsylvania exposed a broader campaign targeting **Unitronics Vision Series PLCs** used in water and wastewater operations. Attackers linked to the pro-Iran **Cyber Av3ngers** group reportedly defaced facility screens and disrupted a remote water pressure station, prompting operators to take affected equipment offline and switch to manual or backup processes; officials said drinking water quality and core service were not affected because the compromised system was isolated from the main treatment plant. Reporting also cited a separate incident at a North Texas utility, underscoring concern that internet-exposed industrial control systems are being actively targeted across the sector. U.S. and Irish authorities later tied similar activity to exploitation of weakly secured or internet-accessible Unitronics controllers, including default or poor password practices and the vulnerability tracked as `CVE-2023-6448`, which was added to CISA's Known Exploited Vulnerabilities catalog. In Ireland, attackers disrupted water service to about 160 households in County Mayo after compromising a PLC at a private group water scheme. CISA warned water operators to remove PLCs from direct internet exposure, change default credentials, enforce multifactor authentication where possible, and back up device configurations as officials and experts warned that undersecured operational technology poses an ongoing risk to critical infrastructure.
Jun 29, 2026
**Iran-linked CyberAv3ngers** activity targeting **Unitronics Vision PLCs** in internet-exposed operational technology environments is the clearest common security event in the provided material. The reporting describes campaigns against critical infrastructure, especially **water and wastewater systems**, with attackers exploiting **default credentials**, weak segmentation, and exposed OT assets to gain access and potentially disrupt operations or manipulate industrial processes. The activity is framed as part of broader Iranian state-linked cyber operations aligned with regional geopolitical tensions, with emphasis on U.S. and allied infrastructure at risk of operational and possible physical consequences. One reference provides technical and threat-context detail on the **CyberAv3ngers/IRGC-linked** targeting of Unitronics devices, while another discusses the wider cyber dimension of conflict involving Iranian groups pre-positioning in U.S. networks and threatening sectors such as water, hospitals, finance, and power. That second piece is relevant as contextual support for the same Iran-linked critical infrastructure threat environment, though it is broader and less specific to the **Unitronics PLC** intrusion pattern. The remaining references cover unrelated topics including malicious npm packages, GitHub repository compromise, Ivanti EPMM exploitation, a Ukraine-focused backdoor campaign, AI security commentary, and vendor detection updates, and do not describe the same incident or disclosure.
Jun 29, 2026
The U.S. State Department offered up to **$10 million** for information on six Iranian government hackers allegedly linked to the Islamic Revolutionary Guard Corps Cyber-Electronic Command and the **CyberAv3ngers** campaign targeting **Unitronics Vision Series PLCs** used in critical infrastructure, including U.S. water utilities. U.S. officials said the group exploited internet-exposed devices with default credentials and, in late 2023, defaced compromised systems with anti-Israel messages while claiming the attacks were retaliation for Israel’s actions in Gaza. One of the most visible incidents hit the Municipal Water Authority of Aliquippa, Pennsylvania, which temporarily shifted to manual operations after an intrusion reached a pressure-regulating pump, though officials said water treatment and safe drinking water were not affected. In response, **CISA** began directly contacting water utilities with exposed Unitronics devices and urged operators to change default passwords, while the FBI and EPA said only a small number of utilities were known to be impacted but warned that exposed PLCs could provide a foothold for deeper network access and potential physical damage.
Jun 29, 2026