U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks

The U.S. Department of State’s Rewards for Justice program has announced a reward of up to $10 million for information leading to the identification or whereabouts of Amir Yaryab, a senior figure in Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC).

U.S. officials allege that Yaryab oversees the command’s Cyber Operations Command, managing cyber units responsible for attacks on critical infrastructure across the U.S., Europe, and the Middle East.

This reward is part of broader efforts to combat malicious cyber activities targeting U.S. critical infrastructure, as outlined under the Computer Fraud and Abuse Act.

U.S. Offers $10 Million Reward

Yaryab is said to lead various components within the IRGC-CEC known as Shahid Hemmat and Shahid Shushtari, both involved in cyber and cyber-enabled information campaigns against multiple sectors, including defense, telecommunications, energy, and finance.

U.S. authorities have linked Yaryab to several IRGC-affiliated groups, including CyberAv3ngers and Dadeh Afzar Arman (DAA), which have been implicated in malware incidents and assaults on civilian infrastructure worldwide.

This recent announcement has intensified scrutiny on the Iranian cyber command, especially as operational technology systems remain vulnerable to internet-based threats. The alert correlates with past warnings about CyberAv3ngers targeting industrial control systems.

A joint advisory issued by CISA, the FBI, NSA, EPA, and international collaborators revealed that IRGC-connected actors began compromising Israeli-made Unitronics Vision Series programmable logic controllers (PLCs) in late 2023. These devices are essential in various sectors, including water treatment, energy, transportation, and healthcare.

Reports indicate that between November 2023 and January 2024, CyberAv3ngers initiated multiple waves of attacks against U.S. based Unitronics PLCs, compromising at least 75 devices, 34 of which were in the U.S. water and wastewater sector.

The attackers primarily targeted internet-exposed devices that used default passwords or lacked password protection. The cyber offensive was not merely a matter of defacement; it involved altering the ladder logic within PLCs, which directly manage the operations of physical devices such as pumps and valves.

Unauthorized changes could disrupt essential functions, and attackers also tampered with device names, software versions, and remote access credentials, complicating recovery efforts.

Moreover, in some incidents, individuals responsible for these attacks replaced human-machine interface (HMI) displays with messages asserting responsibility and threatening Israeli-made equipment. This interference can obstruct plant operators from accessing crucial operational data.

CyberAv3ngers’ activities highlight the significant risks to critical infrastructure posed by weak operational technology security. When attackers compromise PLCs, they can take control of critical industrial processes, leading to potentially disastrous consequences.

In response, organizations operating PLCs and HMIs are urged to mitigate risks by identifying and eliminating devices directly exposed to the public internet. Strong password policies, multifactor authentication, and other security measures should be enforced.

For those using Unitronics Vision Series PLCs, CISA recommends updating engineering workstations and firmware to the latest versions and securing remote access through VPNs and firewalls.

Additionally, maintaining updated asset inventories and monitoring for unusual activities can help prevent such cyber threats. The ongoing activities of CyberAv3ngers underscore the urgent need for robust cybersecurity measures in industrial systems to defend against state-aligned adversaries seeking to disrupt critical services.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.