IOCONTROL cyberweapon used to target infrastructure in the US and Isreael

Claroty’s Team82 and reporting detail a custom, modular IoT/OT malware family named IOCONTROL used by an Iran-linked APT (CyberAv3ngers/IRGC-CEC) to target Israeli and U.S. infrastructure—notably Orpak and Gasboy fuel management/payment systems and various IP cameras, routers, PLCs and HMIs. The malware establishes persistence via a rc3.d boot script, communicates with MQTT C2 over TLS port 8883 with DoH for evasion, encrypts configs with AES-256-CBC, supports remote execution and scanning, and reportedly affected hundreds of devices with IoCs provided in the full analysis.