216.73.216.226

CyberAv3ngers

· Published 17/12/2025 22:50 · Modified 27/03/2026 01:44 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
17/12/2025 22:50
Modified
27/03/2026 01:44
Updated at
27/03/2026 01:44
Revoked
No
Author / Source
The MITRE Corporation
Resource level
Primary motivation
Related entities
1 reports, 20 attack patterns (mitre), 1 malware, 2 sectors, 2 countries, 3 indicators, 1 campaign

Aliases

Soldiers of Soloman

Description

The [CyberAv3ngers](https://attack.mitre.org/groups/G1027) are a suspected Iranian Government Islamic Revolutionary Guard Corps (IRGC)-affiliated APT group. The [CyberAv3ngers](https://attack.mitre.org/groups/G1027) have been known to be active since at least 2020, with disputed and false claims of critical infrastructure compromises in Israel.(Citation: CISA AA23-335A IRGC-Affiliated December 2023) In 2023, the [CyberAv3ngers](https://attack.mitre.org/groups/G1027) engaged in a global targeting and hacking of the Unitronics [Programmable Logic Controller (PLC)](https://attack.mitre.org/assets/A0003) with [Human-Machine Interface (HMI)](https://attack.mitre.org/assets/A0002). This PLC can be found in multiple sectors, including water and wastewater, energy, food and beverage manufacturing, and healthcare. The most notable feature of this attack was the defacement of the devices user interface.(Citation: CISA AA23-335A IRGC-Affiliated December 2023)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references