Unitronics Vision PLC Web/HMI
This is a defensive tool-intelligence page. It is intended for analyst navigation, source review, and hunt planning. It is not a malware-analysis report and does not contain sample code or binaries.
Summary
- Associated actor(s): CyberAv3ngers
- Tool type(s): Targeted technology
- Confidence level(s): High
- Source ID(s):
SRC-CISA-AA23-335A
Behavior
| Actor | Behavior Summary |
|---|
| CyberAv3ngers | Internet-exposed HMI-capable Unitronics PLCs targeted in IRGC-affiliated activity. |
Hash And IOC Status
| Actor | Status | Reference |
|---|
| CyberAv3ngers | Not malware; no hash. Exposure and configuration indicators only. | SRC-CISA-AA23-335A |
Hashes and IOCs on this page are source pointers or representative public indicators. They SHOULD be refreshed from the linked source before operational use and MUST NOT be used alone for actor attribution.
Defensive Hunting Notes
| Actor | Hunting Notes |
|---|
| CyberAv3ngers | Inventory internet-exposed PLC/HMI paths, enforce passwords, restrict remote access, and monitor HMI defacement attempts. |
Handling Notes
| Actor | Handling Notes |
|---|
| CyberAv3ngers | Use for exposure management and OT triage. |
Crosslinks
Mapped ATT&CK Techniques For Associated Actor(s)
These detections are mapped through the associated actor or scenario and are not automatically tool-specific. Promote a tool-specific detection only after the behavior is tied to telemetry and test evidence.
These hunts are mapped through the associated actor or scenario and may need narrowing before they are used for this specific tool.
Source Review
| Source | Publisher | Date | Reliability | Type | Last Reviewed |
|---|
SRC-CISA-AA23-335A | CISA | 2023-12-01 | A | Government advisory | 2026-05-14 |
If a source publishes a large or frequently changing IOC appendix, keep the current IOC list in the source system or TIP and store only the pointer here.