CyberAv3ngers: Iran-linked cyber research activity

This case study was originally published in OpenAI’s October 2024⁠(opens in a new window) report.

Actor

We banned accounts, which based on an assessment from a credible source, appear to belong to an adversary known as CyberAv3ngers that has been publicly reported as affiliated with Iran’s IRGC. Accounts operated by this threat actor used our models to research vulnerabilities, debug code, and ask for scripting advice.

Behavior

Based on open-source information, the CyberAv3ngers group is known for its disruptive attacks against industrial control systems (ICS) and programmable logic controllers (PLCs) used in water systems, manufacturing, and energy systems. Infrastructure targeted by this group is typically associated with Israel, the United States, or Ireland.

Recent attacks have included compromise of PLCs at the Municipal Water Authority of Aliquippa in Pennsylvania (November 2023) and a two-day disruption of water services in County Mayo, Ireland (December 2023). These campaigns often take advantage of default / weak passwords or well documented vulnerabilities in PLCs in combination with open-source tools for scanning and exploiting industrial control systems.

Much of the behavior observed on ChatGPT consisted of reconnaissance activity, asking our models for information about various known companies or services and vulnerabilities that an attacker would have historically retrieved via a search engine. We also observed these actors using the model to help debug code.

Completions

The tasks the CyberAv3ngers asked our models in some cases focused on asking for default username and password combinations for various PLCs. In some cases, the details of these requests suggested an interest in, or targeting of, Jordan and Central Europe.