Organization

IRGC

0 mentions in 7 days · 5 in 30 days · 5 total · first seen Aug 26, 2026 · last 8d ago

Timeline5 articles

OpenAI disrupts 20 campaigns to misuse its tech as federal officials mull international use of AI

OpenAI disrupted 20+ nation-state operations misusing ChatGPT, including CyberAv3ngers using it for reconnaissance and malware code debugging.

OpenAI's 54-page threat report detailed more than 20 disrupted operations by actors from China, Iran, Russia, Israel and other countries using ChatGPT for writing malware code, rewriting phishing emails and reconnaissance. Banned accounts linked to Iran's CyberAv3ngers (tied to the IRGC) queried default PLC credentials, asked about obfuscating malicious code and researched known vulnerabilities; OpenAI judged the AI use offered no novel capability. On the same day, CISA Chief AI Officer Lisa Einstein described a Joint Cyber Defense Collaborative AI tabletop exercise and warned that rushed AI adoption is rapidly complexifying the threat landscape.

The RecordSep 8, 00:00 UTC · 8d agoAI safety & security

US offering $10 million for info on Iranian hackers behind IOControl malware

US offers up to $10 million for information on CyberAv3ngers' 'Mr. Soul,' whose IOControl malware targets US and worldwide ICS/SCADA devices.

The State Department announced a reward of up to $10 million for information on an online persona known as Mr. Soul (or Mr. Soll) tied to CyberAv3ngers, which conducts malicious cyber activity for Iran's IRGC Cyber-Electronic Command. CyberAv3ngers used the IOControl malware against ICS/SCADA devices in the US, Israel and worldwide, targeting products from Unitronics, D-Link, Hikvision and Baicells, according to Claroty and Armis analyses. The malware allows remote control of infected devices and lateral movement within victim networks. The reward follows an August action offering rewards for and sanctioning six Iranian government hackers and comes amid the widening Israel-Iran military conflict.

The RecordSep 8, 00:00 UTC · 8d agoPolicy & legal in the wild 3 sources

US offers $10 million for info on Iranian leaders behind CyberAv3ngers water utility attacks

The US offered $10 million for information on six IRGC-CEC officials behind CyberAv3ngers' 2023 hacks of Unitronics PLCs at US water utilities.

The State Department named six Iranian security officials, including IRGC Cyber-Electronic Command head Hamid Reza Lashgarian, and offered up to $10 million for information on their whereabouts. CyberAv3ngers publicly claimed compromises of Israel-made Unitronics Vision PLCs in October 2023, forcing the Municipal Water Authority of Aliquippa, Pennsylvania, to take systems offline and switch to manual operations. The US had sanctioned the six men in February for targeting critical infrastructure, and CISA notified water operators using Unitronics devices while urging default-password changes. A watchdog also criticized the EPA for lacking a comprehensive water-sector cyber risk strategy.

The RecordSep 8, 00:00 UTC · 8d agoPolicy & legal in the wild 3 sources

US offers $10 million for info on Iranian allegedly behind cyberattacks on critical infrastructure

State Department offers $10M reward for IRGC Cyber-Electronic Command chief Amir Yaryab over critical infrastructure cyberattacks across US, Europe, and Middle East.

The U.S. State Department posted a $10 million reward for information on senior Iranian official Amir Yaryab, who allegedly leads the IRGC's Cyber-Electronic Command (CEC) and directs hacking groups including CyberAv3ngers, Dadeh Afzar Arman (DAA), and Mehrsam Andisheh Saz Nik (MASN). These groups used malware to target defense, news, shipping, travel, energy, financial, and telecommunications sectors in the US, Europe, and the Middle East. The reward follows accusations of renewed Iranian attacks on water utilities, with over 100 entities breached across at least 12 US states since late July, and comes amid broader US-Iran tensions.

The RecordSep 8, 00:00 UTC · 8d agoPolicy & legal 2 sources

Nimbus Manticore Expands Toolset With TWOSTROKE

Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.

Group-IB reported new Tortoiseshell infrastructure spanning Europe and the Middle East and two previously undocumented tools from IRGC-linked Nimbus Manticore (UNC1549): a reverse SSH tunneling utility connecting to 172.86.98.113 on port 443, and a C++ backdoor masquerading as wtsapi32.dll with three hard-coded C2 servers. The backdoor overlaps with TWOSTROKE and supports file transfer, execution, host information gathering, and persistence. Findings build on Kaspersky's report of the NightLedger backdoor and WebSocket tunnelers BridgeHead and ArcBridge, and suggest expanded targeting beyond the Middle East into Europe.

The Hacker NewsAug 26, 15:35 UTC · 20d agoThreat actor in the wild

Appears with

threat actor CyberAv3ngers 4 vendor Unitronics 2 organization US State Department 2 organization CISA 2 victim Municipal Water Authority of Aliquippa 2 threat actor Shahid Shushtari 1 threat actor Shahid Hemmat 1 threat actor Dadeh Afzar Arman 1 malware NightLedger 1 malware IOControl 1 ai model ChatGPT 1 threat actor Nimbus Manticore 1 organization EPA 1 organization Google Threat Intelligence Group 1 threat actor UNC1549 1 organization JCDC 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.