IOControl
MITRE
Malware Type:
Other
Other
First seen:
Unknown
Unknown
Last seen:
Unknown
Unknown
Details:
IOControl is a malware that targeted Linux ARM-based IoT/OT devices including Hikvision IP cameras, D-Link firewalls and routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel management systems, and Baicells LTE controllers across the United States and Israel. The malware has been attributed to [CyberAv3ngers](https://attack.mitre.org/groups/G1027) which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL)
Associated Techniques (9)
| ID | ATT&CK | Tactics |
|---|---|---|
| T1027.002 | Software Packing | - |
| T1027.013 | Encrypted/Encoded File | - |
| T1033 | System Owner/User Discovery | - |
| T1037.004 | RC Scripts | - |
| T1070.004 | File Deletion | - |
| T1070.009 | Clear Persistence | - |
| T1082 | System Information Discovery | - |
| T1124 | System Time Discovery | - |
| T1140 | Deobfuscate/Decode Files or Information | - |
Metadata
| ID: | 440000 |
| Created: | 14/10/2026 04:00 |
| Updated: | 14/10/2026 16:00 |