Iranian cyber operatives have intensified their assault on American critical infrastructure, with Intelligence Group 13 emerging as a primary threat actor targeting water treatment facilities, electrical grids, and industrial control systems across the United States. The group, operating under the umbrella of the Islamic Revolutionary Guard Corps (IRGC) Shahid Kaveh Cyber Group, has demonstrated sophisticated capabilities in penetrating and compromising industrial control systems, particularly Unitronics programmable logic controllers (PLCs) that manage essential infrastructure operations. Their recent campaigns have successfully infiltrated water treatment facilities in Pennsylvania, including the highly publicized Aliquippa water system attack, where attackers gained unauthorized access to control systems and leaked compromising screenshots through their propaganda channels. The group’s technical arsenal demonstrates advanced understanding of industrial control systems architecture, with particular expertise in exploiting Unitronics PLCs commonly used in water treatment and distribution facilities. The group’s ability to leak control panel screenshots and system configuration details demonstrates comprehensive access to target environments, highlighting the severity of their infrastructure penetration capabilities. DomainTools researchers identified the group’s sophisticated tradecraft, which includes deploying custom malware tools such as IOControl and Project Binder specifically designed to manipulate industrial control systems. Intelligence Group 13’s operational methodology centers on pre-positioning malware within target environments, creating dormant implants that can be activated for future sabotage operations. Their attack vectors typically involve credential harvesting through spear-phishing operations, followed by lateral movement within operational technology networks to reach supervisory control and data acquisition (SCADA) systems. The attackers leverage phishing campaigns, credential theft, and open-source intelligence gathering to gain initial access to target networks, subsequently establishing persistent footholds within critical infrastructure environments. Their approach involves embedding malware implants deep within industrial control networks, often masquerading as legitimate system processes or maintenance utilities.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 16 Jul 2025 06:40:13 +0000