New IOCONTROL malware used in critical infrastructure attacks

**IOCONTROL** is a modular nation-state level IoT/OT malware linked to the Iranian group CyberAv3ngers that has been observed compromising diverse critical-infrastructure devices (routers, PLCs/HMIs, fuel management systems like Orpak/Gasboy) in campaigns against Israel and the U.S.; Claroty recovered UPX-packed samples from a Gasboy payment terminal and documents capabilities such as persistent installation, MQTT C2 (port 8883) with DoH, AES-256-CBC configuration encryption, dynamic libc-based command execution, port scanning, and self-deletion, and provides IoCs to help defenders identify and block the threat.