Threat actor · all actors
Cyber Av3ngersMISP-286db62d state
🇮🇷 IR
aka Cyber Av3ngers, CyberAv3ngers, Shahid Kaveh Group
Last updated: 2026-10-16
1attributed CVEs
0ATT&CK techniques
3.2IDF score (tooling uniqueness)
0exclusive CVEs
2021–2026years active
About this actor
Cyber Av3ngers is an Iranian IRGC Cyber-Electronic Command-affiliated threat actor that targets internet-exposed operational technology and industrial control systems. Public reporting documents disruptive targeting of Israeli-made Unitronics PLCs and HMIs, broader critical-infrastructure targeting, and use of the IOCONTROL malware against IoT and OT devices.
How we know this
- Data origin
- MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
- Techniques
- No ATT&CK techniques mapped.
- Named victims
- None on file.
Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.
See how actor data is built for the full pipeline.
Activity timeline
CVE publishedKEV added
- 2026 — 1 KEV added
- 2021 — 1 CVE published
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2021-22681 KEV | 9.9 | 9.8 | 0.6363 | 2021-03-03 | see CVE |
No techniques attributed.
Co-occurring actors
- AnonOps 1 shared CVEs
- Soldiers of Solomon 1 shared CVEs
- Storm-0784 1 shared CVEs
- SuchSecurity Ransomware 1 shared CVEs
Similar actors
Overlapping CVEs
- Soldiers of Solomon 1.00
- Storm-0784 1.00
- SuchSecurity Ransomware 1.00
- AnonOps 0.00
Active in same years
Same nation-state
- HomeLand Justice 1.00
- Outer Space 1.00
- Juicy Mix 1.00
- Cleaver 1.00
- OilRig 1.00
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00