$10 Million Bounty on an IRGC Cyber Commander: What the Amir Yaryab Case Reveals About the Real State of Critical Infrastructure Security
Quick Answer: The U.S. State Department is offering up to $10 million for information on Amir Yaryab, an IRGC Cyber-Electronic Command official tied to CyberAv3ngers' attacks on U.S. water systems. It's a signal that PLC and OT exposure is a national security problem, not just an IT one.
Last verified: September 11, 2026
In late 2023, a water utility operator in Pennsylvania looked at a human-machine interface screen and saw something that shouldn't have been there: a defaced display, a political message, and a booster station that had quietly stopped doing what it was told. Nobody breached a firewall in the traditional sense. Nobody phished an employee. Someone on the other side of the world simply typed a default password into an internet-facing programmable logic controller (PLC) and started flipping switches.
Almost three years later, that incident — and dozens like it — has a name attached to it. On September 3, 2026, the U.S. Department of State's Rewards for Justice (RFJ) program announced a reward of up to $10 million for information leading to the identification or location of Amir Yaryab, a senior official inside Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). If you run a SOC, manage an OT environment, or advise on state-sponsored cyberattacks on critical infrastructure, this case is worth understanding in detail — not as geopolitical trivia, but as a live case study in how nation-state actors weaponize weak industrial control system hygiene.
Table of Contents
- Who Is Amir Yaryab, and Why Does the U.S. Want Him?
- Inside the Rewards for Justice Offer
- CyberAv3ngers: The Operational Arm Behind the PLC Attacks
- Anatomy of the Attack: How Unprotected PLCs Were Compromised
- Indicators and Techniques Worth Knowing
- Detection and Prevention for OT/ICS Environments
- Expert Tips for SOC and OT Teams
- FAQ
- Conclusion
Who Is Amir Yaryab, and Why Does the U.S. Want Him?
According to the Rewards for Justice announcement, Yaryab leads the IRGC-CEC's Cyber Operations Command and directs multiple internal components, including units identified as Shahid Hemmat and Shahid Shushtari. U.S. officials allege these units run cyber and cyber-enabled information operations against organizations across the United States, Europe, and the Middle East, spanning defense, media, shipping, travel, energy, financial services, and telecommunications — a sector list broad enough to cover almost anything the IRGC considers strategically useful to disrupt.
It's worth noting that coverage of Yaryab's exact title varies slightly between outlets — most describe him as the head of the Cyber Operations Command, while at least one report characterizes him as deputy head. Some coverage also states he holds the rank of Brigadier General and previously served as a military attaché before moving into cyber command roles. Treat the rank and career-history details as reported, not independently verified, since they trace back to a single source rather than the primary RFJ notice.
Inside the Rewards for Justice Offer
The reward falls under the authority the State Department uses to target individuals who, "while acting at the direction or under the control of a foreign government," engage in malicious cyber activity against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act (CFAA). This isn't a first — RFJ has run similar bounty programs against other Iranian and Russian state-linked actors — but the timing matters. It follows separate Justice Department allegations that Iran-linked actors breached employee email accounts at the Department of Labor, the Federal Energy Regulatory Commission, and multiple United Nations bodies, along with Treasury sanctions against Iranian nationals tied to infrastructure attacks. Taken together, this reads like a coordinated pressure campaign rather than an isolated announcement.
CyberAv3ngers: The Operational Arm Behind the PLC Attacks
RFJ states that Yaryab oversees IRGC-CEC-affiliated groups, most notably CyberAv3ngers, along with Dadeh Afzar Arman (DAA) and a group referenced as Mehrsam Andisheh Saz Nik (MASN). Of these, CyberAv3ngers is the one most security practitioners will recognize — it's the persona behind one of the more consequential ICS/SCADA security incidents of the past few years.
CyberAv3ngers has also claimed responsibility for other actions, including an alleged 2023 breach of ORPAK Systems, an Israeli gas-station technology provider, and claims of possessing data tied to Israeli electricity infrastructure. Those claims come from the group's own statements and have not been independently confirmed in the same way as the PLC campaign, so they should be read as attributed claims rather than established fact.
Anatomy of the Attack: How Unprotected PLCs Were Compromised
The best-documented part of this story is the campaign against Unitronics Vision Series PLCs, covered in a joint advisory from CISA, the FBI, NSA, and the EPA (AA23-335A). Here's the sequence, reconstructed from that advisory and related reporting:
- Reconnaissance: Attackers scanned the internet for Unitronics Vision Series PLCs and their companion human-machine interfaces (HMIs) exposed directly to the public internet.
- Initial access: Many of these devices were reachable using default credentials or no authentication at all — no exploit chain required, just exposed management interfaces.
- Impact: Between November 2023 and January 2024, at least 75 Unitronics devices in the U.S. were compromised, 34 of them within water and wastewater utilities. Attackers altered ladder logic — the programming language that governs how a PLC controls physical equipment like pumps and valves.
- Obfuscation and disruption: In several cases, attackers changed device names, software versions, and remote access credentials, and replaced HMI display content with defacement messages — complicating both incident response and public trust.
None of this required advanced tradecraft. It required an internet-exposed PLC and a default password. That's the uncomfortable part for defenders: the barrier to entry for disrupting physical infrastructure was startlingly low.
Indicators and Techniques Worth Knowing
If you're responsible for OT asset inventory or SOC triage, the patterns to watch for from this campaign include:
- Unitronics Vision Series PLCs and HMIs reachable from the public internet (check via Shodan-style exposure audits, not just internal scans).
- Devices still running factory-default or unchanged administrative credentials.
- Unexpected changes to ladder logic, device naming conventions, or firmware/software version strings.
- HMI screens displaying unauthorized content or messages.
- Remote access credentials that were modified without a corresponding change-management ticket.
None of these are exotic detection signatures — they're basic configuration-drift indicators that most OT monitoring tools can already flag, provided someone is actually watching for them.
Detection and Prevention for OT/ICS Environments
CISA's guidance for Unitronics-affected organizations, and general best practice for similar PLC security vulnerabilities, breaks down into a few concrete actions:
- Eliminate direct internet exposure. No PLC or HMI should have a public-facing IP address. If remote access is required, route it through a VPN with multifactor authentication rather than exposing the device management port directly.
- Change default credentials immediately on any internet-facing or newly deployed industrial device, and enforce a credential rotation policy for OT assets the same way you would for domain admin accounts.
- Update firmware and engineering workstation software to vendor-current versions, and track OT patch cycles separately from IT patch cycles, since OT change windows are usually far more constrained.
- Maintain a current asset inventory. You cannot protect — or even notice a compromise on — a device that isn't in your inventory. This is where many OT network security solutions earn their keep, by passively fingerprinting ICS/SCADA assets without disrupting operations.
- Monitor for configuration drift on ladder logic, device names, and firmware versions, and alert on any change that didn't originate from an approved change ticket.
None of these controls guarantee immunity from an incident — no control set does — but they close the exact gap CyberAv3ngers exploited.
Example: Basic exposure check using Shodan CLI
shodan search "Unitronics Vision"
This command queries Shodan's index for internet-exposed Unitronics devices. It's useful for defenders auditing whether their own organization's assets show up in public exposure databases — it should never be used to probe or interact with devices you don't own or have written authorization to test.
Expert Tips for SOC and OT Teams
- Treat OT asset exposure audits as a recurring quarterly task, not a one-time project — new devices get deployed, and old exceptions creep back in.
- If your organization operates critical infrastructure, build a direct communication channel with your sector's Information Sharing and Analysis Center (ISAC) so advisories like AA23-335A reach your OT team same-day, not weeks later through a vendor mailing list.
- Don't assume "air-gapped" OT networks are actually air-gapped. Many of the compromised Unitronics devices were assumed to be isolated until an audit proved otherwise.
- For organizations without in-house 24/7 OT monitoring capability, evaluating SOC as a service providers with dedicated ICS/SCADA expertise is often more realistic than trying to build that capability internally on a compressed timeline.
- Factor incidents like this into renewal conversations around critical infrastructure cyber insurance — insurers are increasingly asking for OT-specific exposure documentation, and having it ready shortens underwriting friction.
Related Cybersecurity Topics You Should Explore
- Panzer Ransomware Targets Italian Manufacturers With ESXi-Ready Malware
- BigBear 2.0 Evilginx2 Phishing Bypasses Microsoft 365 MFA With Session Cookie Theft
- Veradigm Data Breach: How a Stolen Vendor Login Exposed Patient SSNs
- Hackers Hide Windows Backdoor Inside HiveMQ and Element Chat
- Plex Emailed Users Over Hidden Security Flaws — Update Now
- TP-Link Archer AX55 Flaws Let Hackers Steal Admin Access
- Trezor ShipMonk Breach Widens to 80,000+ US Customers
- Microsoft Teams QR Code Protection: What Changes in October 2026
- Dahua Camera Backdoor Survives Password Resets and Factory Resets
FAQ
What is the Rewards for Justice program?
Rewards for Justice is a U.S. State Department program that offers financial rewards for information leading to the identification, location, or arrest of individuals involved in activities that threaten U.S. national security, including state-sponsored cyberattacks.
Who is Amir Yaryab?
He is identified by U.S. officials as a senior figure in Iran's IRGC Cyber-Electronic Command, allegedly overseeing cyber units including Shahid Hemmat and Shahid Shushtari, and affiliated hacking groups such as CyberAv3ngers.
What is CyberAv3ngers?
CyberAv3ngers is an IRGC-linked hacking persona best known for compromising internet-exposed Unitronics Vision Series PLCs in U.S. water and wastewater facilities between late 2023 and early 2024.
Were any water systems actually disrupted?
Per the CISA/FBI/NSA/EPA joint advisory, attackers altered PLC ladder logic and defaced HMI displays at affected facilities. The advisory does not claim a confirmed loss of safe drinking water service, but it does describe direct manipulation of operational technology controlling pumps and valves.
How did attackers gain access without sophisticated exploits?
By finding PLCs and HMIs exposed directly to the internet and using default or missing passwords — no zero-day or custom malware was required for initial access.
What should organizations running Unitronics or similar PLCs do right now?
Remove any direct internet exposure, change default credentials, update firmware, and monitor for unauthorized configuration changes, following the mitigations outlined in CISA advisory AA23-335A.
Does this reward guarantee Yaryab will be located or prosecuted?
No. Reward programs increase the incentive for actionable tips but do not guarantee identification, arrest, or prosecution, particularly for individuals operating from jurisdictions without extradition cooperation with the U.S.
Conclusion
The $10 million figure attached to Amir Yaryab's name is designed to grab headlines, and it will. But the more useful takeaway for anyone actually defending infrastructure isn't the bounty — it's the reminder that the CyberAv3ngers campaign succeeded on the back of avoidable misconfigurations, not novel tradecraft. State-sponsored actors don't need to be sophisticated when defenders leave the front door open. If you operate any OT or ICS environment, use this case as the excuse you needed to run that exposure audit you've been postponing.
Have you already audited your PLC and HMI exposure this quarter? Drop your approach in the comments, or share this with a colleague on your OT team who still thinks their network is air-gapped.
Analysis based on SOC monitoring and public threat intelligence review.