Skip to main content
OT Atlas

Threats · Activity group

BAUXITE

activeOT-focused accessDragosAttribution · Moderate
Last verified

Executive summary

BAUXITE is the Dragos activity group associated with attacks on internet-exposed industrial devices across water, energy and manufacturing. Public reporting describes technical overlap with the hacktivist-branded persona CyberAv3ngers, which CISA and partner agencies have linked to IRGC-affiliated actors.

The tradecraft is deliberately low-cost: find industrial devices reachable from the internet, use default or weak credentials, and produce visible defacement or disruption. The consequence for small utilities is disproportionate to the sophistication required.

At a glance

Tracked byDragos
NexusCISA and partners have linked associated CyberAv3ngers activity to IRGC-affiliated actors
First observed2023
Last reported2024–2025 reporting on exposed device compromise
ICS kill chainStage 1 — Reconnaissance · Stage 1 — Intrusion · Stage 2 — Execute ICS attack

Rosetta Stone

Names across the industry

Every edge states the kind of relationship the public source supports — an alias is not the same as an overlap.

BAUXITE
  • CyberAv3ngers
    Technical overlapModerate

    Tracked by CISA / multiple vendors — Public technical overlap reported; sources do not universally state identity.

Relevance

Why OT defenders care

Objectives

  • Compromise of internet-exposed PLCs and HMIs
  • Visible disruption and defacement for influence effect
  • Development of more destructive capability

Reported impacts

  • Loss of view and loss of control at small water utilities
  • Manual operation required while devices were restored

Observed behaviours

  • Internet-wide scanning for exposed industrial devices
  • Login using unchanged factory default credentials
  • HMI defacement and controller stoppage

Targeting

Sectors, geography and assets

Target industries

Water and wastewaterElectric powerOil and gasManufacturing

Target geography

United StatesIsraelEurope

Observed assets

PLC (including Unitronics Vision series)HMICellular routerInternet-exposed control device

Protocols in scope

PCOMModbus TCPHTTP/HTTPS device interfacesVNC

Capability

Malware and tools

Malware, commercial tooling, open-source utilities and native operating-system tools are kept separate — they demand different detections.

Malware

  • Reported wiper and destructive toolingReported by vendors in associated activity; details vary by source.

Commercial tool

Not publicly established

Open-source utility

Not publicly established

Native OS tool

  • Device default credential abuseReported use of factory default access rather than exploit code.

ATT&CK

Technique mapping

ATT&CK Enterprise

ATT&CK for ICS

History

Known campaigns and incidents

Reported campaigns

  • 2023 compromise of Unitronics devices at US water utilities

Atlas incident case studies

Defence

Defensive hunting priorities

Start with the hunts below — each one is a complete procedure in the Field Playbook.

Priorities

  • Remove control devices from direct internet exposure; place them behind a VPN with MFA
  • Change all factory default credentials and default ports on field devices
  • Continuously monitor your own external attack surface for reappearing exposures
  • Keep tested device configuration backups for rapid restoration

Hunt for this activity

Indicators

Indicator guidance

Indicators expire. Behaviour usually ages better.

This registry deliberately does not republish volatile IP and domain lists. Pull current indicators from the linked authoritative reporting, match them locally against your own telemetry, and invest your standing detections in the behaviours listed above.