CISA Issues Joint Advisory on IRGC-Linked CyberAv3ngers Exploiting U.S. Critical Infrastructure PLCs

FBI, CISA, NSA, EPA, DOE, and USCYBERCOM issued a joint advisory warning that Iranian-affiliated CyberAv3ngers are actively exploiting internet-facing Rockwell Automation programmable logic controllers across U.S. water, energy, and government facilities. The group, linked to the IRGC Cyber Electronic Command, has escalated from default-credential exploitation to deploying custom ICS malware and actively manipulating HMI/SCADA displays, causing operational disruptions. Six IRGC-CEC officials were sanctioned by OFAC in 2024 for directing CyberAv3ngers operations. The advisory urges immediate isolation of affected PLCs from the internet.