Full Report
Not-for-profit organization MITRE has released details of version 20 of its ATT&CK framework, expanding its coverage of critical... The post MITRE ATT&CK v20 expands critical infrastructure threat coverage with new IT and OT attack techniques appeared first on Industrial Cyber.
Analysis Summary
# Tool/Technique: IOControl (S9046 / G1027), with ATT&CK v20 ICS Command and Scripting Interpreter Updates
> **Source note:** The article is a news summary of the MITRE ATT&CK v20 release (October 16, 2026) and is truncated. It does not include hashes, file names, C2 infrastructure, or YARA rules. Those fields are marked accordingly. Background details marked *(prior public reporting)* come from earlier public research on IOCONTROL and are not from this article.
## Overview
**IOControl** is Linux-based malware attributed to the Iranian threat group CyberAv3ngers (G1027). MITRE added it to ATT&CK v20 as Software S9046. It targets Internet of Things (IoT) and operational technology (OT) devices, including programmable logic controllers (PLCs), human-machine interfaces (HMIs), and fuel management systems.
The v20 release pairs IOControl with a new ICS Campaign, C0066 (2026 U.S. Water Utilities Attacks), which reached internet-facing PLCs at more than 30 Minnesota water and wastewater utilities and locked operators out of their systems. Its addition also coincides with new ICS Command and Scripting Interpreter and command-and-control sub-techniques, which allow analysts to map activity to the specific interpreter or protocol used.
## Technical Details
- **Type:** Malware family (IoT/OT Linux malware)
- **Platform:** Linux-based IoT and OT devices, including PLCs, HMIs, and fuel management systems
- **Capabilities:** Not detailed in the article. *(Prior public reporting)* describes IOCONTROL as a Linux/embedded-device implant that targets OT-connected equipment and can be used for command execution and remote control.
- **First Seen:** Not stated in the article. *(Prior public reporting)* first documented IOCONTROL in late 2024.
## MITRE ATT&CK Mapping
The article confirms the following mappings. Other techniques used by IOControl are not listed.
- **Execution (ICS)**
- **T1701 – Command and Scripting Interpreter** (added to ICS in v20)
- T1701.001 – PowerShell
- T1701.002 – Windows Command Shell
- *Four additional sub-techniques were added but are not listed in the truncated text.*
- **Command and Control (ICS)**
- *Two new command-and-control sub-techniques were added for protocol abuse (including DNS and publish/subscribe). IDs are not provided in the article.*
Tactic IDs are not provided in the article. Verify them against the current ATT&CK for ICS matrix before use.
## Functionality
### Core Capabilities
- Targets Linux-based IoT and OT devices
- Affects PLCs, HMIs, and fuel management systems
- Supports command execution on industrial devices (per the ICS Command and Scripting Interpreter mapping)
### Advanced Features
- Command and control over protocols that industrial networks already use, including DNS and publish/subscribe *(new v20 sub-techniques)*
- Activity tied to a campaign (C0066) that caused operator lockout, indicating destructive or disruptive intent
## Indicators of Compromise
- **File Hashes:** Not provided in the article.
- **File Names:** Not provided in the article.
- **Registry Keys:** Not applicable (Linux-based malware).
- **Network Indicators:** None provided in the article. Obtain C2 domains and IPs from the ATT&CK Software page (S9046) or vendor reports, and defang them before sharing (e.g., `example[.]com`, `192[.]0[.]2[.]1`).
- **Behavioral Indicators:**
- Unexpected command interpreter execution on PLCs, HMIs, or engineering workstations
- Outbound DNS or publish/subscribe traffic from OT devices that do not normally generate it
- Unauthorized changes to PLC or HMI configuration, or operator lockout events
## Associated Threat Actors
- **CyberAv3ngers (G1027)**: Iranian-linked group. The article does not describe a link to C0066, which the article says has not been formally attributed.
## Detection Methods
- **Signature-based:** Not provided in the article. Use vendor-published hashes and IOCs once verified.
- **Behavioral:**
- Monitor for command and scripting interpreter activity on or near OT assets.
- Alert on DNS queries and publish/subscribe messages that originate from PLCs, HMIs, or other field devices.
- Use the new v20 industrial analytics and asset-aware detection strategies, which the article says filter routine engineering and maintenance activity, to reduce false positives.
- Map detections to specific assets, such as engineering workstations and PLCs.
- **YARA rules:** Not provided in the article.
## Mitigation Strategies
- **Prevention measures:**
- Remove direct internet exposure of PLCs and other OT devices. The C0066 campaign targeted internet-facing PLCs.
- Enforce network segmentation between IT and OT, and restrict cross-domain paths. The related C0064 campaign spanned both environments.
- Change default credentials and require authentication for PLC and HMI access.
- **Hardening recommendations:**
- Restrict or monitor DNS and publish/subscribe traffic from OT networks with allowlists.
- Disable unneeded command interpreters and services on Linux-based embedded devices where feasible.
- Maintain offline, tested backups of PLC and HMI configurations to speed recovery from lockout events.
- Apply vendor patches and monitor fuel management and other IoT-connected systems.
## Related Tools/Techniques
- **BACKUPOSINT v9.0 APEX PREDATOR (S9045):** An AI-generated, 49-module Python toolkit added in v20 and used in the C0064 Mexico breach. It is not related to IOControl in the article.
- **Campaign C0064 – AI-Assisted Breach of Mexico's Government Infrastructure:** A cross-domain IT/OT campaign that reached a municipal water utility.
- **Campaign C0066 – 2026 U.S. Water Utilities Attacks:** Targets internet-facing PLCs at water utilities. Pairs with IOControl in the v20 release.
- **T1701 Command and Scripting Interpreter (ICS):** Parent technique for the new interpreter-specific sub-techniques.