Power companies in the UK have been put on alert after hackers linked to the Islamic Revolutionary Guard Corps (IRGC) shut down an energy site.
The attack took place in July and is suspected to have been carried out by a group calling itself CyberAv3ngers, which is affiliated with the IRGC's electronic warfare arm and specialises in breaching infrastructure.
The Department for Energy Security and Net Zero has insisted the attack was on a small plant and that at no point was there a risk to the wider energy system.
But the National Cyber Security Centre (NCSC), which is a branch of the signals intelligence agency GCHQ, has sent out an alert to energy companies, the department added.
“In response to this specific incident, the NCSC and Department for Energy Security and Net Zero briefed energy CEOs and directly wrote to companies with advice, direction and next steps,” said a representative.
“The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards."
Michael Shanks, the Minister for Energy, said the government and industry had taken the incident seriously and were working with regulators and the NCSC to assess threats and strengthen protections.
Richard Moore, the former head of the MI6 overseas spy agency, said the UK faced cyber attacks from a number of states.
“The fact is that a combination of China, Russia, Iran, and North Korea are all focused on cyber-attacks against the UK, as they are against many other western and democratic societies, and again, it comes back to the importance for us of building our own resilience and ability,” he told the BBC.
The IRGC's electronic warfare arm is headed by Hamid Lashgarian, who was placed under sanctions in 2024 by the US. Washington has offered a $10 million reward for information about his activities.
The US says that CyberAv3ngers are affiliated with the IRGC’s Cyber-Electronic Command.
The hackers have compromised the Vision series of programmable logic controllers (PLCs) made by Israel-based Unitronic.
The PLCs are rugged, industrial-grade computers designed to automate machinery, manufacturing lines, and critical infrastructure.
They are used by the water and wastewater, energy, food and beverage, manufacturing, healthcare and other industries.
A recent report by cyber security company Tenable found that CyberAv3ngers has “repeatedly compromised small water utilities, municipal facilities, and rural energy operators, and the reason is structural, not coincidental”.
Tenable said many of these organisations use remote access tools such as TeamViewer or AnyDesk and also expose their PLCs “directly to the public internet,” making them vulnerable to attack.
