IOControl
- ID
- S9046
- Type
- Malware
- Source
- attack.mitre.org
- MITRE last modified
- 13 Oct 2026
IOControl is a malware that targeted Linux ARM-based IoT/OT devices including Hikvision IP cameras, D-Link firewalls and routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel management systems, and Baicells LTE controllers across the United States and Israel. The malware has been attributed to CyberAv3ngers which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).[1][2][3]
Techniques used (9)
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1033 System Owner/User Discovery
- T1037.004 RC Scripts
- T1070.004 File Deletion
- T1070.009 Clear Persistence
- T1082 System Information Discovery
- T1124 System Time Discovery
- T1140 Deobfuscate/Decode Files or Information