BlastWaveBlastWaveHACKOPEDIA
Hackopedia • File 025
Aliquippa, Pennsylvania, US, and other sites

CyberAv3ngers Unitronics Campaign and Aliquippa Water Incident (2023)

Volume 2Water edition2023Last verified 21 sources, 13 primaryUS government attribution

In November 2023 IRGC-affiliated actors put a slogan on internet-facing water controllers; the only US utility named ran its station by hand. Retellings later read a vendor’s cluster that overlaps the persona as that state.

The photo that made this incident famous is a screen, and a screen is roughly all it took: controllers answering the internet on a default port, behind the factory password or none. Then the counting. At least 34 devices in US water, a year later, became “utilities” in coverage and in our own research list. One US utility has been named, by itself. Its station alarmed, staff ran it by hand, and, in the chairman’s words, nobody was ever at risk.

The second half is a weld. Dragos says its BAUXITE cluster overlaps the persona and “does not corroborate nor conduct political attribution.” The government calls the persona IRGC-affiliated. Retellings, ours included, joined the two. A 2026 advisory listed Bauxite among names industry uses: reported usage, not identity. Dragos’s June 2025 wipers carry no government attribution and no named victim. That every known entry point was an internet-facing device is BlastWave’s analysis: none of the controls waits on the flag.

What is not known: The 34 counts devices, published a year later, and no document says how many utilities they belong to. Which password Aliquippa’s controller carried is unpublished: CISA said only “likely.” The Irish outage is known from press alone. The BAUXITE overlap rests on capabilities and infrastructure Dragos has not itemised, and no document says cluster and persona are one operator. The June 2025 wipers have no named victim, sector or effect, and no government attribution.

Recommendation

  1. Take the path away No controller, HMI or firewall management page answers from the public internet. It is the control that does not depend on knowing who is knocking.
  2. Remove credential-based access Change the factory default, then stop depending on any shared password: engineering access goes through one gate that knows who is connecting.
  3. Make read-only consumers read one way Send the values out on a path that cannot write back, so seeing the pressure never requires a door into the pump.
The Road-Work Sign
Podcast · Joe and Cam · 9:05
CyberAv3ngers Short
Video · 60 to 90 seconds

Sources: AA23-335A, 1 Dec 2023 (updated Dec 2024); CISA Alert, 28 Nov 2023; Treasury jy2072, 2 Feb 2024; Dragos Year in Review, Feb 2025 and 17 Feb 2026; Dragos BAUXITE profile; AA26-097A, 7 Apr 2026. Full list with links.

Soft Spots: The 34 is devices, not utilities. Aliquippa’s password is on no record. Overlap is Dragos’s; the IRGC finding is the government’s, about the persona; the alias list is reported usage. The wipers rest on one vendor.

The full record

Every claim numbered to its source. Last updated .

A slogan where the pressure readings should be, a booster station run by hand, and two later retellings that outran the record. What is verified, what is only reported, and what is still unknown.

Summary

In November 2023, actors the US government calls IRGC-affiliated, using the persona CyberAv3ngers, logged in to internet-facing Unitronics controllers and replaced operator screens with a slogan. At Aliquippa, Pennsylvania, the booster station alarmed and staff ran it by hand; no process impact is on record. The federal count, at least 34 in US water, counts devices, not utilities.2,3

Timeline of the CyberAv3ngers campaign and the BAUXITE record

Every date is tied to a source. Press reporting appears only as evidence of what was said.

  1. The joint advisory later dates the campaign's activity "since at least November 22, 2023."2
  2. An alarm goes off at the Municipal Water Authority of Aliquippa's booster station, which regulates pressure for Raccoon and Potter townships. Staff take control manually.1,10
  3. CISA issues an alert: the utility took the system offline and switched to manual operations, and there is "no known risk to the municipality's drinking water or water supply." CISA tells operators to ensure the default password "1111" is not in use.3
  4. Senators Casey and Fetterman and Rep. Deluzio ask Attorney General Merrick Garland to investigate.11
  5. FBI, CISA, NSA, EPA and the Israel National Cyber Directorate publish AA23-335A, naming "IRGC-affiliated cyber actors using the persona 'CyberAv3ngers'."2
  6. WaterISAC describes the actors as "low-skilled actors using unsophisticated tactics," in quotation marks, linked to a SentinelOne blog post that we have not read. The same day, AP reports the authority's chairman saying federal officials told him the group breached "four other utilities and an aquarium."12,13
  7. NVD publishes CVE-2023-6448, a default administrative password in Unitronics VisiLogic. CISA adds it to the Known Exploited Vulnerabilities catalog on 11 December.14
  8. Irish press reports about 180 homes on a group water scheme in Erris, County Mayo, without water on "Thursday and Friday." The Record later reports about 160 households; SecurityWeek writes that it is "unclear" whether this group was behind it.8
  9. Treasury sanctions six officials of the IRGC Cyber-Electronic Command over the Unitronics screen operation, and says it "did not disrupt any critical services."9
  10. The EPA Administrator and the National Security Advisor write to governors that IRGC-affiliated actors "targeted and disabled" operational technology at a facility that "neglected to change a default manufacturer password." The letter names no facility.15
  11. AA23-335A is updated with a count: "at least 75 devices, including at least 34 in the WWS Sector in the United States."2
  12. Dragos introduces BAUXITE, a cluster it says shares "substantial technical overlaps" with the CyberAv3ngers persona. The same day, SecurityWeek writes that Bauxite "has been linked to Iran" and is "operating under the hacktivist persona CyberAv3ngers."4,16
  13. Dragos reports that the CyberAv3ngers persona sent politically charged threatening emails, which it says "lacked any specific threat or stated intent to attack."7
  14. Dragos assesses, with high confidence, that BAUXITE deployed two wiper variants against "unspecified targets in Israel" during the Israel and Iran conflict. No government document attributes them.7
  15. Dragos publishes its 2026 Year in Review, reporting the wipers and the threatening emails.7,17
  16. Advisory AA26-097A lists "Bauxite" among names that "private industry and open sources also refer to this group as." It is updated on 22 July 2026.18

Key facts and their status

Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.

QuestionWhat the record saysStatus
Who did the US government name?"IRGC-affiliated cyber actors using the persona 'CyberAv3ngers'"2Verified
How many devices were compromised?At least 75, including at least 34 in US water and wastewater2Verified (December 2024 count)
How many US water utilities?No document says. One named anywhere: Aliquippa, by itself1,2Undisclosed
Was Aliquippa's drinking water affected?"No known risk to the municipality's drinking water or water supply" (CISA)3Verified (time-bound)
Which password did Aliquippa's controller have?Unpublished. CISA said "likely" poor password security and internet exposure3Undisclosed
Were critical services disrupted?Treasury: "did not disrupt any critical services"9Verified
Was water service lost anywhere?Ireland, about 160 to 180 homes for two days; actor link "unclear" in the coverage itself8Reported only
Is BAUXITE the same group?Dragos reports "substantial technical overlaps," not identity, and does not conduct political attribution4,5Researcher finding
Does the government call BAUXITE an alias?It reports that "private industry and open sources" use the name18Verified (reported usage)
Who used the June 2025 wipers?BAUXITE, Dragos assesses with high confidence. No government attribution7Researcher finding
Victims of the wipers"Unspecified targets in Israel"; none named, no effect described7Undisclosed
Cost of the incidentsNot publishedUndisclosed

What happened at the Aliquippa water authority?

A controller at a booster station was defaced, the station alarmed, and staff ran it by hand; no process impact is on the record. The Municipal Water Authority of Aliquippa, in Beaver County, Pennsylvania, said the affected station monitors and regulates pressure for Raccoon and Potter townships, and that an alarm went off.1 CISA's alert of 28 November 2023 said the utility took the system offline and switched to manual operations, and that there was "no known risk to the municipality's drinking water or water supply."3 The authority's chairman described it this way:

"They did not get access to anything in our actual water treatment plant, or other parts of our system, other than a pump that regulates pressure to elevated areas of our system. The booster station did what it was supposed to. It sent an alarm and we took control manually. Nobody was ever at risk."
Matthew Mottes, chairman, Municipal Water Authority of Aliquippa, to BeaverCountian.com, as quoted by WaterWorld, 30 November 2023 (the original's dashes rendered as commas)10

The authority serves over 6,600 customers.10 It is the only US water utility named anywhere in connection with the campaign, and it named itself. No federal advisory names it. Treasury, sanctioning six officials over the operation in February 2024, wrote that "this particular operation did not disrupt any critical services."9 A 2026 advisory describes the 2023 campaign as "causing disruptive effects"; that phrase is about the campaign's effect on operator screens, Treasury's is about services, and each is quoted here with its owner.18

The chairman also told AP that federal officials had told him the same group breached "four other utilities and an aquarium."13 That is his account of what he was told. None of those organizations has been named, and the statement does not appear in any federal document we have read.

How many US water utilities did CyberAv3ngers hack?

No document says. The federal count is of devices, not utilities, and it arrived a year after the attacks. The December 2023 advisory gave no device count; it said "the victims span multiple U.S. states."2 The update of 18 December 2024 added the number:

"The actors compromised at least 75 devices, including at least 34 in the WWS Sector in the United States."
Joint Cybersecurity Advisory AA23-335A, as updated 18 December 20242

The updated advisory says "the victims spanned multiple U.S. states and foreign countries" and gives no country list.2 It does not say how many utilities the 34 devices belong to. "34 water utilities hacked" and every variant of it turns a count of devices into a count of organizations.

Dragos counts its view of the Unitronics campaign differently: "nearly 100 OT/ICS organizations" globally, from November 2023 to January 2024.6 That is a different author and a different noun. The two numbers are not reconciled or added together here.

How did the attackers get into the controllers?

By logging in to controllers that answered the public internet with a factory default password or none, according to the advisory. At Aliquippa, CISA said only "likely." The advisory describes Unitronics Vision Series PLCs with integrated HMI, exposed on default TCP port 20256, and says the compromised devices "either had a default password in place or no password."2,3 The actors uploaded a defacement image to the operator screen. Campaign-wide, that splash page "prevented operators from reading anything the display screen would normally show."2 No malware family is named for the 2023 wave.

The password "1111" is the Unitronics factory default, which CISA named as something to check for.3 NVD records the default administrative password as CVE-2023-6448: "Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password."14 About the Aliquippa device, CISA said the actors likely accessed it by exploiting weaknesses "including poor password security and exposure to the internet."3 Which password that controller carried has never been published.

The March 2024 letter from the EPA Administrator and the National Security Advisor says IRGC-affiliated actors "targeted and disabled a common type of operational technology used at water facilities where the facility had neglected to change a default manufacturer password."15 The letter names no facility, and it is not evidence about Aliquippa.

Is BAUXITE the same group as CyberAv3ngers?

No document says so. Dragos reports technical overlap and declines political attribution; the US government's IRGC finding is about the persona and the 2023 campaign. BAUXITE is the label Dragos gives a cluster of activity it tracks. In February 2025 Dragos wrote that the cluster:

"shares substantial technical overlaps, based on capabilities and network infrastructure, with the hacktivist persona CyberAv3ngers, which has explicit affiliations with the Iranian Revolutionary Guard Corps, Cyber and Electronic Command (IRGC-CEC), as reported by the U.S. Government"
Dragos, press release, 25 February 2025 (the original's dash rendered as a comma)4

Dragos's BAUXITE profile adds: "Dragos does not corroborate nor conduct political attribution to threat activity."5 Its February 2026 release says BAUXITE "exhibits technical overlap with activity the U.S. Government assesses is aligned with CyberAv3ngers and IRGC-CEC."17 The government's finding sits beside Dragos's own, labelled as the government's. Two facts, two owners: the overlap is Dragos's, the IRGC affiliation is the government's, about the persona. Nobody has published that BAUXITE is an IRGC operation. Dragos has not itemized the capabilities and infrastructure behind the overlap.

Dragos describes four BAUXITE campaigns since late 2023, including Stage 2 impacts "via trivial compromises of exposed devices":4

  • Exposed Unitronics Unistream and Vision series PLCs, November 2023 to January 2024.6
  • Sophos firewalls, April to May 2024, with "enterprise impact on chemical, food and beverage, and water and wastewater industries."6
  • The IOControl backdoor, a Linux backdoor with command and control over MQTT, on "over 400 global OT/ICS devices and firewalls."5,6
  • Scanning in June and July 2024, "likely to identify potential targets for future operations."6

Retellings joined the two sentences. On the day of Dragos's release, SecurityWeek wrote that Bauxite "has been linked to Iran" and was "operating under the hacktivist persona CyberAv3ngers."16 Overlap became operating under.

In April 2026 a federal advisory reported the name. Its background paragraph on the 2023 campaign reads:

"During a similar campaign beginning in November 2023, the IRGC CEC-affiliated cyber threat actors known as 'CyberAv3ngers' targeted U.S.-based PLCs and HMIs, causing disruptive effects. Private industry and open sources also refer to this group as Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691, and the Shahid Kaveh Group."
Joint Cybersecurity Advisory AA26-097A, 7 April 2026; identical in the 22 July 2026 update18

Read the verb. The government is reporting what others call the group, not finding that cluster and persona are one operator. The same advisory attributes its own 2026 activity to "a group of Iranian-affiliated advanced persistent threat (APT) actors," not to CyberAv3ngers.18 The government attribution of the 2023 campaign does not extend to that 2026 activity, to the 2025 wipers or to BAUXITE's other campaigns.

Did CyberAv3ngers use wiper malware?

No government has said so. Dragos assesses, with high confidence, that its BAUXITE cluster deployed two wiper variants against unspecified targets in Israel in June 2025. Dragos's 2026 report places the wipers during the conflict between Israel and Iran, and says it assessed with high confidence that BAUXITE "had deployed two wiper variants" against "unspecified targets in Israel."7

"Although these wipers were not ICS-specific, their use in campaigns that targeted industrial entities reflects a willingness to impose operational downtime"
Dragos, OT Cybersecurity Report: A Year in Review, 17 February 20267

Dragos's release describes the move as "escalating from prior access and disruption to destructive intent."17 Destructive intent is Dragos's phrase; no destruction is described. No victim, sector, effect or entry point is on the record, the wipers are not ICS-specific, and no government document attributes them to anyone. Nothing on the record makes them CyberAv3ngers' wipers, Iran's wipers or an attack on water.

Dragos separately attributes politically charged threatening emails in May 2025 to "the CyberAv3ngers hacktivist persona," sent from an address associated with a prior CyberAv3ngers Telegram contact profile, and says they "lacked any specific threat or stated intent to attack."7 Dragos assigns those emails to the persona, not to BAUXITE and not to the IRGC.

What is still not known about CyberAv3ngers

  • How many utilities the at least 34 US water devices belong to. The advisory counts devices.2
  • Which password Aliquippa's controller carried. CISA said only "likely."3
  • The cost of any of the incidents.
  • The Irish outage beyond press reports: the exact dates, the count (reports vary between households, homes and people) and who was responsible.8
  • Which "four other utilities and an aquarium" the chairman was told about. None has been named.13
  • Which countries the campaign reached. The advisory says "multiple U.S. states and foreign countries"; Dragos and other summaries give different sets.2
  • The capabilities and infrastructure behind Dragos's overlap finding. Dragos has not itemized them, and no document says cluster and persona are one operator.
  • The victims, sector, effect and entry point of the June 2025 wipers. No government document attributes them.7

Claims about CyberAv3ngers the record does not support

Widely repeated claimWhat the record says
"34 US water utilities were hacked."At least 34 devices in US water, counted in December 2024. No document says how many utilities. One US water utility has been named, by itself.2
"Aliquippa's water supply was affected."The station alarmed and was run by hand. CISA: "no known risk" to the drinking water. Treasury: no critical services disrupted.3,9,10
"The utilities left their passwords set to 1111."1111 is the product's factory default, which CISA named as a thing to check for. At Aliquippa CISA said "likely" poor password security; the actual password is unpublished. The phrasing appears in a Fast Company headline.3,19
"The US government confirmed Iran is behind cyberattacks on water companies."The advisory names IRGC-affiliated actors using the CyberAv3ngers persona and counts devices. It counts devices, not companies, and one US water utility has been named, by itself. The phrasing is a TechRadar headline.2,20
"Bauxite, linked to Iran, operates under the CyberAv3ngers persona."Dragos reports technical overlap, not identity, and "does not corroborate nor conduct political attribution." SecurityWeek ran the joined version on the day of Dragos's release.4,5,16
"The government confirmed BAUXITE is another name for CyberAv3ngers."AA26-097A reports names that "private industry and open sources" use. It is not an identity finding, and the same advisory does not attribute its own 2026 activity to CyberAv3ngers.18
"CyberAv3ngers (or Iran) used wipers on water systems."Dragos alone, high confidence: two wipers, June 2025, "unspecified targets in Israel," not ICS-specific, no victim. No government attribution.7
"The federal advisory called them low-skilled actors.""Low-skilled actors using unsophisticated tactics" is WaterISAC's text, in quotation marks, linked to a SentinelOne blog post that we have not read.12
"Ireland was without water for several days; the campaign hit four countries."Press reported two days. The advisory says "multiple U.S. states and foreign countries"; vendor summaries give different country sets. Both phrases appear in a Tenable summary.2,8,21

What did the US government do after the 2023 campaign?

Congressional letters. On 30 November 2023, Senators Casey and Fetterman and Rep. Chris Deluzio asked Attorney General Merrick Garland to investigate the attack on the Aliquippa authority.11

Vulnerability listing. CVE-2023-6448, the Unitronics default administrative password, was published on 5 December 2023 and added to CISA's Known Exploited Vulnerabilities catalog on 11 December 2023.14

Sanctions. On 2 February 2024, Treasury's Office of Foreign Assets Control designated six officials of the IRGC Cyber-Electronic Command "in response to IRGC-affiliated cyber actors' recent cyber operations in which they hacked and posted images on the screens of programmable logic controllers manufactured by Unitronics, an Israeli company."9 The release does not use the name CyberAv3ngers or any persona name, and names no utility.

"In this case, the United States, in coordination with the private sector and other affected countries, quickly remediated the incidents with minimal impacts."
US Department of the Treasury, press release jy2072, 2 February 20249

Letter to governors. On 18 March 2024, EPA Administrator Michael Regan and National Security Advisor Jake Sullivan wrote to governors that IRGC-affiliated actors had "targeted and disabled" operational technology at a water facility that had not changed a default manufacturer password. The letter names no facility.15

BlastWave analysis: the path and the fallback decided it

Analysis, not a disclosed fact

The photo that made this incident famous is a screen, and a screen is roughly all it took: controllers answering the internet on their default port, behind the factory password or none. Aliquippa is the plainest part. The station alarmed, staff took it by hand, and, in the chairman's words, nobody was ever at risk. That is fallback capacity working, at a small authority, on the Saturday after Thanksgiving.10 This is an architecture story about a class of device, not a competence story about a small authority.

Our reading is that the decisive variables were the path, a controller reachable by anyone, and the fallback, a crew who could run the station by hand. Every campaign in either record whose entry point is known began at a device that answered the internet, so none of the controls below waits on who was knocking. Dragos does not say how the wipers got in. That reading is BlastWave's analysis, not a finding in any document.2,4

How BlastWave removes the paths an attacker uses to reach OT

Listen and watch

Podcast: “The Road-Work Sign” (9:05). Joe Baxter and Cam Cullen on why the sign does not care who pulled over, only whether it was parked on the shoulder.

Video: CyberAv3ngers Short (60 to 90 seconds).

Frequently asked questions

What happened in the CyberAv3ngers Unitronics attacks?

From at least 22 November 2023, according to a joint federal advisory, actors the US government calls IRGC-affiliated, using the persona CyberAv3ngers, logged in to Unitronics controllers exposed to the internet with a default password or none, and replaced operator screens with a slogan. The advisory, updated in December 2024, counts at least 75 devices compromised, including at least 34 in US water and wastewater. That is a count of devices, not utilities.

What happened at the Aliquippa water authority?

On Saturday 25 November 2023, the controller at a booster station of the Municipal Water Authority of Aliquippa, Pennsylvania, was defaced and the station alarmed. Staff took control manually. CISA said on 28 November 2023 there was no known risk to the municipality's drinking water or water supply, and the authority's chairman said the booster station did what it was supposed to and nobody was ever at risk.

How many US water utilities were hacked by CyberAv3ngers?

No public document says. The joint advisory AA23-335A, as updated in December 2024, counts at least 34 compromised devices in the US water and wastewater sector, without saying how many utilities they belong to. The only US water utility named anywhere is the Municipal Water Authority of Aliquippa, which named itself. Its chairman's report of four other utilities and an aquarium, relayed from federal officials, names no one.

Did Aliquippa use the default password 1111?

That has never been published. 1111 is the Unitronics factory default, which CISA told operators to check for in its 28 November 2023 alert. About the Aliquippa device, CISA said the actors likely got in by exploiting weaknesses including poor password security and exposure to the internet. The advisory's finding that devices had a default password or none applies across the campaign, not to any named utility.

Who is behind CyberAv3ngers?

The FBI, CISA, NSA, EPA and Israel's National Cyber Directorate said in December 2023 that IRGC-affiliated cyber actors used the CyberAv3ngers persona in the Unitronics campaign. In February 2024 the Treasury Department sanctioned six officials of the IRGC Cyber-Electronic Command over the operation, without naming the persona. Treasury said the operation did not disrupt any critical services.

Is BAUXITE the same as CyberAv3ngers?

No document says they are one operator. Dragos, which coined the name BAUXITE in February 2025, says its cluster shares substantial technical overlaps with the CyberAv3ngers persona, and states that it does not corroborate nor conduct political attribution. A federal advisory of April 2026 lists Bauxite among names that private industry and open sources use for the group, which reports others' usage rather than making an identity finding.

Did CyberAv3ngers deploy wiper malware?

No government has said so. In February 2026, Dragos said it assessed with high confidence that its BAUXITE cluster deployed two wiper variants against unspecified targets in Israel in June 2025. Dragos said the wipers were not ICS-specific. No victim, sector or effect has been disclosed, and no government document attributes the wipers to anyone.

Did anyone lose water because of the CyberAv3ngers campaign?

No US loss of water service is on the record. Irish press reported in December 2023 that about 160 to 180 homes on a group water scheme in Erris, County Mayo, were without water for two days, and SecurityWeek wrote it was unclear whether this group was responsible. It is known from press alone and is not a finding of any federal advisory or Irish authority.

US Water CampaignThe escalation pair: an unattributed 2026 wave that changed passwords and addresses and produced pressure loss and flooding, with its own record and no actor borrowed from this one.Israeli WaterThe other half of the made-in-Israel logic: there an unnamed-source claim hardened into fact; here a slogan hardened into a count of utilities.TwoNet Water HoneypotThe opposite failure in the same sector: a hacktivist claim of water disruption that a honeypot log shows was not real.

Sources

Primary sources are federal advisories and alerts, the Treasury release, congressional and executive letters, the vulnerability record, and Dragos's own publications for Dragos's findings. Statements by the Aliquippa authority are cited through the outlets that published them. Press is cited only as evidence of what was said.

  1. PressKDKA / CBS Pittsburgh, "Municipal Water Authority of Aliquippa hacked by Iranian-backed cyber group," 25 to 26 November 2023. Cited for the authority's own statements. cbsnews.com
  2. FederalFBI, CISA, NSA, EPA and Israel National Cyber Directorate, Joint Cybersecurity Advisory AA23-335A, "IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities," 1 December 2023; updated 18 December 2024 (co-sealed by the UK NCSC and the Canadian Centre for Cyber Security). cisa.gov · December 2023 text (PDF) · IC3 (PDF)
  3. FederalCISA, Alert, "Exploitation of Unitronics PLCs used in Water and Wastewater Systems," 28 November 2023, updated 19 December 2023. cisa.gov
  4. ResearcherDragos, press release, "Dragos Reports OT/ICS Cyber Threats Escalate Amid Geopolitical Conflicts and Increasing Ransomware Attacks," 25 February 2025. dragos.com
  5. ResearcherDragos, threat group profile, "BAUXITE." dragos.com
  6. ResearcherDragos, "OT/ICS Cybersecurity Report: A Year in Review" (8th annual), February 2025, BAUXITE section. PDF
  7. ResearcherDragos, "OT Cybersecurity Report: A Year in Review" (9th annual), 17 February 2026, BAUXITE section. dragos.com
  8. PressBreakingNews.ie, "Anti-Israeli hackers leave 180 Mayo homes without water in cyberattack," 7 December 2023, citing the Western People; The Record, 11 December 2023; SecurityWeek, "Cyberattack on Irish Utility Cuts Off Water Supply for Two Days," December 2023. Cited as evidence of what was reported. breakingnews.ie · therecord.media · securityweek.com
  9. FederalUS Department of the Treasury, press release jy2072, "Treasury Sanctions Actors Responsible for Malicious Cyber Activities on Critical Infrastructure," 2 February 2024. The release does not use the name CyberAv3ngers or any persona name. treasury.gov
  10. PressJeremy Wolfe, WaterWorld, "Aliquippa, Pennsylvania suffers cyberattack on booster station PLC," 30 November 2023, quoting authority chairman Matthew Mottes's remarks to BeaverCountian.com. Cited for the chairman's own words. waterworld.com
  11. GovernmentOffice of Rep. Chris Deluzio, "Deluzio, Casey, Fetterman Call for DOJ Investigation Into Cyberattack on Aliquippa Water Authority," 30 November 2023 (letter to Attorney General Merrick Garland). deluzio.house.gov
  12. ResearcherWaterISAC (Jennifer Walker), "CISA and Partners Confirm Additional Activity into Exploitation of Unitronics PLCs Across the U.S. Water and Wastewater Sector," 2 December 2023. waterisac.org
  13. PressAssociated Press via WHYY, "Pa. water authority one of several organizations breached by Iran-affiliated hackers, federal agencies say," 2 December 2023. Cited as evidence of what was said. whyy.org
  14. FederalNIST National Vulnerability Database, CVE-2023-6448, published 5 December 2023; added to CISA's Known Exploited Vulnerabilities catalog 11 December 2023.
  15. FederalMichael S. Regan, EPA Administrator, and Jake Sullivan, Assistant to the President for National Security Affairs, letter to governors, 18 March 2024. The letter names no facility. PDF
  16. PressSecurityWeek, "Nine Threat Groups Active in OT Operations in 2024: Dragos," 25 February 2025. Cited as evidence of what was said. securityweek.com
  17. ResearcherDragos, press release, "Dragos OT Cybersecurity Report: Adversaries Increase Real-World Impact, Map Control Loops Across Industrial Infrastructure," 17 February 2026; and Dragos blog, "Dragos 2026 OT Cybersecurity Year in Review Now Available," February 2026. businesswire.com · Dragos blog
  18. FederalFBI, CISA, NSA, EPA, DOE and USCYBERCOM Cyber National Mission Force, Joint Cybersecurity Advisory AA26-097A, "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure," 7 April 2026; updated 22 July 2026 (adds the Department of the Treasury). PDF · 22 July 2026 update (PDF)
  19. PressFast Company, "U.S. water utilities were hacked after leaving their default passwords set to '1111,' cybersecurity officials say." Cited as evidence of what was said. fastcompany.com
  20. PressTechRadar, "US government confirms Iran is behind cyberattacks on water companies." Cited as evidence of what was said. techradar.com
  21. PressTenable, 9 April 2026, on AA26-097A. Cited as evidence of what was said.

Cite this page

BlastWave. “CyberAv3ngers Unitronics Campaign and Aliquippa Water Incident (2023): What Is Verified.” Hackopedia, Volume 2, FILE 025. Last verified 15 October 2026. https://hackopedia.blastwave.com/water/cyberav3ngers-2023/

Revision history

DateChange
15 Oct 2026Re-verified against primary sources: the federal advisory quotations were read on cisa.gov and match. The “low-skilled” phrase is confirmed as WaterISAC’s, linked to a SentinelOne post, and is not in the federal advisory. No facts changed.
6 Oct 2026Numbered FILE 025 in Hackopedia Volume 2, in the Water edition.
2 Oct 2026Every quotation from Dragos's 2026 Year in Review checked against the full report; all match. The quotation about the May 2025 emails now appears as a complete sentence.
28 Sep 2026Source check of the chairman's quotation, the AP report, the Irish press reports, Dragos's 2025 figures and the congressional letter. Corrected attribution of "no known risk": CISA's exact words refer to "the municipality's drinking water"; the shorter wording is the authority's.
26 Sep 2026Full re-verification against the advisories, the CISA alert, the Treasury release (read in full; it names no persona) and both versions of the April 2026 advisory. Corrected the EPA letter quotation to its verbatim "targeted and disabled."
25 Sep 2026Expanded to cover Dragos's BAUXITE cluster, so the 2023 campaign and the vendor's cluster are told in one place, each with its own source.
24 Sep 2026Volume 2 entry built from primary sources.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry