CASE DOSSIER fugitive

U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks)

Docket: 2:24-cr-00185 Court: U.S. District Court for the Western District of Pennsylvania Opened: 2024-09-24 Sector: Water and Wastewater Systems, Energy

Key Facts

Status

FUGITIVE

Legal disposition

Loss Amount

$15.0 million

Forced manual pump operations at multiple municipal water authorities across Pennsylvania and New Jersey.

Techniques

Verified mappings

Defendants

Named in charges

Legal Status: FUGITIVE in U.S. District Court for the Western District of Pennsylvania.
Primary Target Sector: Water and Wastewater Systems, Energy.
Documented Financial Loss: $15.0 million.
2 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.

Export structured case data and MITRE ATT&CK Navigator layer:

Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Indictment of members of the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command who compromised Israeli-made Unitronics programmable logic controllers (PLCs) at American municipal water facilities.

Procedural & Incident Timeline

2023-11-28 advisory

CISA publishes alert on exploitation of Unitronics PLCs used in water systems.

2024-02-02 sanction

Treasury OFAC sanctions officials of the IRGC Cyber-Electronic Command.

2024-09-24 indictment

Unsealing of criminal indictment against six Iranian military cyber actors.

Substantiated MITRE ATT&CK Techniques

Technique ID	Technique Name & Tactic	Primary Source Evidence Excerpt	Locator	Verification
T1078	Valid Accounts Defense Evasion	"Defendants gained access to internet-connected Unitronics Vision PLCs because the industrial devices remained configured with the default manufacturer password '1111'."	CISA Advisory AA23-335A ¶ 4	reviewed
T1485	Data Destruction Impact	"Attackers defaced screen displays on industrial pressure monitoring stations with anti-Israel political slogans and halted remote pump regulation."	Indictment ¶ 18, Page 9	reviewed

CISA Cybersecurity Advisories

AA23-335A: IRGC-Affiliated Cyber Actors Exploit Unitronics PLCs in Water and Wastewater Systems

Cite & Embed This Case Record

Public Domain / CC0

Bluebook Legal Citation:

Cyberattack Case Library, U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks), No. 2:24-cr-00185 (U.S. District Court for the Western District of Pennsylvania 2024), https://cyberattackcaselibrary.pages.dev/cases/us-v-irgc-cyberav3ngers-water/

Embeddable Incident Card (HTML):