Ankura CTIX FLASH Update - December 13, 2024

Malware Activity

New IOCONTROL Malware Targets IOT Devices and OT/SCADA Systems

Cybersecurity researchers have identified a new form of malware linked to an Iranian threat actor that targets IOT and OT/SCADA systems used by critical infrastructure in Israel and the United States. Dubbed IOCONTROL, the malware targets devices including routers, programmable logic controllers (PLCs), and fuel management systems among others. IOCONTROL is allegedly linked to CyberAv3ngers, an Iranian hacking group known for attacking industrial control systems. IOCONTROL has been found in Gasboy and Orpak fuel management system infections, although it is unknown how the malware was planted on the systems. The malware is stored in the "/usr/bin/" directory as "iocontrol" and uses a script "S93InitSystemd.sh" to maintain persistence on the infected device. IOCONTROL uses MQTT protocol for command-and-control communications (C2) and resolves C2 domains via DNS over HTTPS. The malware