This dossier delivers a technical evaluation of the cyber-kinetic capabilities, organizational structure, and Industrial Control System (ICS) targeting methodologies executed by the Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). Following structural escalations in the regional kinetic theater, the IRGC-CEC,operating through state-directed Advanced Persistent Threat (APT) personas such as CyberAv3ngers, Handala Hack, and PYROXENE,has shifted its cyber posture from passive espionage and basic web defacements to active, long-range operational technology (OT) sabotage.

This analysis details the technical mechanisms used to compromise Supervisory Control and Data Acquisition (SCADA) networks and Programmable Logic Controllers (PLCs) across Western and regional critical infrastructure. By exploiting internet-exposed edge devices, abusing default manufacturer credentials, and deploying custom ICS-specific malware platforms like IOCONTROL, the IRGC-CEC directly bridges the digital-physical divide, targeting municipal water utilities, energy distribution networks, and fuel management systems to induce physical disruption, economic damage, and psychological panic.

The Organizational Structure of the IRGC Cyber-Electronic Command

The IRGC-CEC operates as an independent, centralized command vertical within the parallel military state, reporting directly to the IRGC General Headquarters and the Supreme Leader. It is tasked with the synchronization of electronic warfare (EW), signals intelligence (SIGINT), and offensive cyberspace operations.

The command structure is organized into specialized clandestine components:

• Unit 73 (Offensive Cyber Directorate): Responsible for the active planning, target selection, and execution of cross-border network intrusions. Unit 73 utilizes a dense array of front companies and fake “hacktivist” collectives to achieve strategic deniability, masking state-sponsored operations under ideological or civilian banners.
• The Shahid Kaveh Research Group: A highly specialized sub-component dedicated to reverse-engineering Western industrial hardware, identifying zero-day vulnerabilities in SCADA software, and developing custom malware frameworks engineered to manipulate physical valves, relays, and pumps.
• The Electronic Operations Room: Coordinated dynamically with other state intelligence organs, this joint operations hub manages over 60 proxy personas and hacktivist cells simultaneously during periods of heightened regional conflict, optimizing the speed and distribution of network attacks against designated adversary economic targets.

Industrial Control System (ICS) Targeting Methodology

The IRGC-CEC’s offensive tradecraft is characterized by an asymmetric, low-cost, high-impact methodology. Rather than relying exclusively on complex, costly zero-day exploits, the command systematically exploits structural under-investment, poor patch hygiene, and internet exposure within critical infrastructure operators.

Initial Access and Internet-Facing PLC Exploitation

The primary access vector utilized by IRGC operators is the aggressive scanning of public-facing internet ranges using automated reconnaissance platforms like Shodan and Censys, coupled with custom query generation engines to rapidly map vulnerable machinery:

1. Default Credential Abuse: Operators target exposed Unitronics Vision Series PLCs equipped with integrated Human-Machine Interfaces (HMIs) by scanning for open TCP port 20256. In multiple confirmed campaigns across municipal water systems, the attackers achieved immediate, administrative operator access by utilizing the manufacturer’s factory-default password (1111), bypassing local firewall filters entirely.
2. Authentication Bypass Vulnerabilities: The command has significantly expanded its target baseline, transitioning to widely deployed, Western-manufactured industrial components. Operators aggressively exploit flaws such as CVE-2021-22681,a critical, unpatched authentication bypass vulnerability in Rockwell Automation / Allen-Bradley Logix controllers (including CompactLogix and Micro850 models). This exploit allows remote actors to use leased, overseas virtual private server (VPS) infrastructure to establish unauthenticated socket connections directly to the device over TCP port 44818.

Technical Analysis of the Sabotage Pipeline

Once administrative access to an internet-exposed PLC is locked, the IRGC-CEC deploys specialized tools to execute system destruction warfare within the physical domain, systematically breaking the integrity of the automated control loop.

The IOCONTROL and Project File Manipulation Vector

Rather than acting as a simple network nuisance, cells like CyberAv3ngers utilize dedicated programming environments,such as Rockwell’s Studio 5000 Logix Designer software running on compromised engineering workstations,to interact directly with the industrial environment:

• Logic Overwriting: Attackers download modified project files directly into the active memory bank of the controller. This allows them to maliciously alter the underlying ladder logic or block diagrams that regulate physical processes, such as chemical dosing speeds in wastewater facilities or valve positions in fuel pipelines.
• Safety Alarm Suppression: The modified code intentionally overwrites safety thresholds and disables automatic shutdown alarms. By forcing a pump to run continuously or closing a pressure relief valve while suppressing the associated alert telemetry, the malware engineers catastrophic cascading equipment failures.

The Human-Machine Interface (HMI) Blinding Tactic

Simultaneously, the command executes “Loss of View” and “Loss of Control” tactics by manipulating the HMI displays observed by human utility personnel:

• Graphic Screen Injection: Operators replace the legitimate graphical user interface on the HMI screen with ideological or threatening imagery (e.g., the anti-Israel/anti-Western defacement screens deployed during the Unitronics campaigns).
• Telemetry Spoofing: More sophisticated cells freeze or spoof the real-time operational data transmitted to SCADA monitoring screens. By feeding static, normal process values (such as tank levels or system pressures) back to the central control room while the physical machine is being driven into an over-pressurized state, the IRGC prevents human operators from recognizing the emergency or executing manual override procedures until the physical destruction is complete.

Strategic Vulnerabilities and Countermeasures

The IRGC-CEC’s cyber-kinetic architecture demonstrates that the vulnerability of Western critical infrastructure is fundamentally an exposure and credential management crisis. By weaponizing automated scanning tools and exploiting unpatched architectural gaps in industrial software, Tehran achieves asymmetric kinetic parity without requiring conventional military deployment.

Targeted Exploitation Parameters

To neutralize this offensive cyber engine, asset owners and national cyber defense agencies must implement strict, non-negotiable operational technology hardening protocols:

• Absolute Removal of Inbound Public Port Exposure: The core vulnerability exploited by groups like CyberAv3ngers and PYROXENE is the direct visibility of industrial protocols on the public internet. Critical infrastructure operators must immediately disconnect all PLCs, HMIs, and cellular field modems from public-facing IP ranges. All remote access requirements must be strictly mediated through segregated network architectures, utilizing unidirectional security gateways, industrial demilitarized zones (DMZs), and dedicated jump hosts that enforce mandatory multi-factor authentication (MFA) and continuous session logging.
• Mandatory Enforcement of Physical Mode Switching: Remote logic manipulation via software tools is completely blocked if the physical hardware controller is properly configured. Utility personnel must audit all deployed programmable controllers and manually turn the physical, on-device mode switch to the hard “RUN” position. This mechanical air-gap permanently restricts remote writing capabilities, ensuring that any modifications to the core control logic can only be executed by a physically present engineer manipulating the hardware interface on-site.
• Behavioral Detection Profiles for the IOCONTROL Pipeline: Because signature-based antivirus solutions consistently fail against Living-Off-the-Land (LotL) tradecraft and polymorphic SCADA malware, network monitoring teams must deploy behavior-based anomaly detection at the industrial perimeter. Defense platforms must be configured to trigger immediate alerts on any unauthorized industrial programming protocols crossing network boundaries,specifically monitoring for unexpected traffic on TCP ports 20256, 44818, 502, and 102, alongside anomalous MQTT-over-TLS (port 8883) and DNS-over-HTTPS configurations originating from within isolated OT network segments.