IRGC-linked CyberAv3ngers hit US water utilities; Florida agency confirms ransomware as US offers $10 million over Unitronics hacks and IOControl malware

Florida's St. Johns River Water Management District confirmed a ransomware incident as the State Department offered up to $10 million for information on IRGC Cyber-Electronic Command officials and the 'Mr. Soul' persona behind CyberAv3ngers'…

Florida's St. Johns River Water Management District, which oversees drinking-water supply planning, confirmed suspicious activity in its IT environment and implemented containment measures; a ransomware gang claimed the attack and shared samples of stolen data. The incident comes as CISA, FBI, NSA, EPA and Israel's INCD warn that IRGC-affiliated CyberAv3ngers are actively compromising Israeli-made Unitronics Vision Series PLCs in the water sector using default credentials — activity the agencies said has been ongoing since at least November 22, and which the group publicly claimed in October 2023. Motivated by opposition to Israel-linked products, the hackers deface controller interfaces and could cause deeper cyber-physical effects; the Municipal Water Authority of Aliquippa, Pennsylvania, was forced to take systems offline and switch to manual operations. Shadowserver found at least 539 Unitronics PLC instances still exposed online, and CNN reported, citing a CISA briefing to Congress, that fewer than 10 US water facilities faced recent attacks. The State Department is offering up to $10 million for information on six Iranian security officials, including IRGC Cyber-Electronic Command head Hamid Reza Lashgarian, whom the US sanctioned in February for targeting critical infrastructure; a second report describes the same $10 million reward as targeting the online persona 'Mr. Soul' (or 'Mr. Soll'), tied to CyberAv3ngers and its IOControl malware — the sources differ on whom the reward targets. IOControl, according to Claroty and Armis analyses, has been used against ICS/SCADA devices in the US, Israel and worldwide, targeting Unitronics, D-Link, Hikvision and Baicells products and enabling remote control of infected devices and lateral movement. The reward follows an August action offering rewards for and sanctioning six Iranian government hackers (one report dates the six men's sanctions to February; the timing differs between reports) and comes amid the widening Israel-Iran military conflict. Separately, a watchdog criticized the EPA for lacking a comprehensive water-sector cyber risk strategy.

• Florida's St. Johns River Water Management District confirmed suspicious activity in its IT environment and implemented containment; a ransomware gang claimed the attack and shared samples of stolen data.
• CyberAv3ngers, affiliated with Iran's IRGC Cyber-Electronic Command (IRGC-CEC), compromises Israeli-made Unitronics Vision Series PLCs in the water sector via default credentials; CISA/FBI/NSA/EPA/INCD said activity has been ongoing since…
• The Municipal Water Authority of Aliquippa, Pennsylvania, was forced to take systems offline and switch to manual operations after a CyberAv3ngers attack.
• Attackers deface Unitronics controller interfaces and could cause deeper cyber-physical effects, per the joint advisory; CISA notified water operators using Unitronics devices and urged default-password changes.
• Shadowserver found at least 539 Unitronics PLC instances still exposed online; CNN reported, citing a CISA congressional briefing, that fewer than 10 US water facilities faced recent attacks.
• The State Department offered up to $10 million: one report says for information on six IRGC-CEC officials including commander Hamid Reza Lashgarian; another says for the 'Mr. Soul'/'Mr. Soll' persona behind IOControl — the sources differ…
• The US sanctioned the six Iranian officials for targeting critical infrastructure; one report dates the sanctions to February, while another references an August action offering rewards for and sanctioning six Iranian government hackers —…
• IOControl malware targets ICS/SCADA devices in the US, Israel and worldwide, including Unitronics, D-Link, Hikvision and Baicells products; it enables remote control of infected devices and lateral movement, per Claroty and Armis analyses.