# ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT 'BH Alert' Android Spyware Targeting Bahrain

> CISA, FBI, and EPA updated advisory AA26-097A (originally April 7, 2026; updated July 22, 2026) on Iranian-affiliated APT actors — linked to IRGC-CEC/CyberAv3ngers tradecraft — using leased infrastructure and legitimate vendor engineering software (Studio 5000 Logix Designer, EcoStruxure Control Expert, TIA Portal) to compromise internet-exposed Rockwell/Allen-Bradley, Schneider Electric, and Siemens PLCs across Water/Wastewater, Energy, and Government Services sectors, inserting malicious Add-On Instructions and disabling shutdown/alarm logic. Separately, a four-stage OctagonPanel/Ward RAT Android spyware platform is distributed via look-alike domains cloning Google Play and official Bahraini government sites under the guise of a 'BH Alert' civil-defense siren app, harvesting lockscreen credentials, intercepting SMS/OTP, running banking overlays, and granting full remote device control.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1659
- **ID:** TL-2026-1659
- **Severity:** HIGH
- **Category:** CAMPAIGN
- **Status:** ACTIVE
- **Actor:** Cyber Av3ngers (Iran)
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This threat bulletin (aggregated from The Hacker News' ThreatsDay roundup, published 2026-07-23) documents two converging campaigns.

**1) Iran-affiliated PLC intrusion campaign (CISA AA26-097A).** CISA, FBI, EPA, and government partners updated an advisory originally issued April 7, 2026, warning of ongoing exploitation of internet-connected operational technology by Iranian-affiliated APT actors whose tradecraft overlaps with IRGC Cyber-Electronic Command (IRGC-CEC) and the previously disclosed CyberAv3ngers persona (first publicized November 2023 for Unitronics PLC defacements). The July 22, 2026 update adds guidance for detecting malicious changes to reusable code modules — specifically malicious Add-On Instructions (AOIs) — within Rockwell Automation PLC programs. Actors used leased, third-party-hosted infrastructure and foreign-sourced IP addresses to reach misconfigured, internet-facing PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens. Rather than exploiting a specific CVE, the actors abused legitimate vendor configuration software — Rockwell Studio 5000 Logix Designer, Schneider Electric EcoStruxure Control Expert, and Siemens Totally Integrated Automation (TIA) Portal — to authenticate to exposed engineering ports, exfiltrate PLC project files, delete project logic, and manipulate data rendered on HMI/SCADA displays. At one victim site, attackers inserted override routines that disabled critical shutdown and alarm logic, and used Dropbear SSH for command-and-control persistence over port 22. Targeted OT protocol ports included 44818 and 2222 (Rockwell EtherNet/IP), 102 (Siemens S7comm), and 502 (Modbus TCP). CISA published 12 malicious source IP addresses with observed activity spanning September 2025 through July 2026. Impacted sectors are Water and Wastewater Systems (WWS), Energy, and Government Services and Facilities, with confirmed operational disruption and financial loss at affected sites. Attribution confidence is assessed MEDIUM by the authoring agencies, who note Iran-affiliated actors have historically used ransomware-gang personas as cover and that attribution to a specific unit remains difficult.

**2) OctagonPanel/Ward RAT 'BH Alert' Android spyware campaign.** Discovered July 17, 2026 by researchers at DreamGroup, this campaign exploits heightened public anxiety after Gulf-nation civil-defense sirens were activated in July 2026 following regional missile threats. Threat actors built a network of look-alike domains (playgoogle.alertbh[.]com, download.alert-bh[.]com, download.bh-security[.]com) cloning both the Google Play Store storefront and official Bahraini government portals, complete with fake install animations and ad-tracking pixels, to distribute a trojanized 'BH Alert' civil-defense siren app via smishing and social-media links. The malware uses a four-stage infection chain: Stage 0 ('Ematterassist') is an RC4-encrypted loader disguised as a font file (ZfChs.ttf) that injects hidden DEX code; Stage 1 (package com.kit.kitty) presents a social-engineering UI requesting invasive Android permissions and silently installs a secondary APK; Stage 2 ('Hvoicemanual') is a secondary RC4-encrypted shell that decrypts and launches the main payload; Stage 3 (package com.kisa.octagonpanel) is the OctagonPanel/Ward RAT itself, which abuses Android AccessibilityService (registered as WardAccessibilityService) to harvest lockscreen PIN/pattern input, intercept SMS and one-time passwords, exfiltrate contacts/call logs, capture screenshots, enumerate installed apps, render phishing overlays atop legitimate banking apps, execute arbitrary remote commands via an encrypted C2 channel, self-exclude from the recent-apps switcher, and deploy a fake VPN service to disrupt legitimate connectivity while preserving attacker C2. The campaign is assessed to primarily target Bahraini (and secondarily Kuwaiti) mobile users during a period of elevated civil-defense app adoption.

**Adjacent items referenced in the same bulletin (lower-confidence, included for tag/technique coverage only, not separately scored):** a GitHub pull-request prompt-injection technique ('GhostCommit') hiding malicious LLM-reviewer instructions inside PNG image bytes to exfiltrate repository secrets; an Iran-nexus group tracked as TAG-182 distributing MarkiRAT via fake VPN/download-tool Android apps targeting the Iranian diaspora, sharing tradecraft with previously reported Ferocious Kitten activity; a TrickBot variant adding DNS-tunneling C2 (encrypted DNS query packets used to carry command traffic) for evasion; and a malvertising campaign ('FakeAgent') redirecting victims to spoofed Claude Artifacts pages serving a trojanized 'ClaudeDesktop.exe' that deploys SectopRAT, affecting at least 29 organizations July 21-22, 2026.

## MITRE ATT&CK

- T0819 Exploit Public-Facing Application
- T0886 Remote Services
- T0807 Command-Line Interface
- T0821 Modify Controller Tasking
- T0843 Program Download
- T0889 Modify Program
- T0848 Rogue Master
- T0861 Point & Tag Identification
- T0868 Detect Operating Mode
- T0869 Standard Application Layer Protocol
- T0885 Commonly Used Port
- T0878 Alarm Suppression
- T0875 Change Program State
- T0836 Modify Parameter
- T1692.002 Reporting Message
- T0837 Loss of Protection
- T0813 Denial of Control
- T1660 Phishing
- T1471 Data Encrypted for Impact
- T1541 Foreground Persistence
- T1406 Obfuscated Files or Information
- T1638 Adversary-in-the-Middle
- T1628 Hide Artifacts
- T1417 Input Capture
- T1417.002 GUI Input Capture
- T1513 Screen Capture
- T1636.003 Contact List
- T1636.004 SMS Messages
- T1636 Protected User Data
- T1437 Application Layer Protocol
- T1582 SMS Control
- T1629.002 Device Lockout
- T1418 Software Discovery
- T1663 Remote Access Software

## Sources

- [ThreatsDay Bulletin: Android Spyware, PLC Attacks, and More](https://thehackernews.com/2026/07/threatsday-android-spyware-plc-attacks.html)
- [Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [CISA, FBI, EPA and U.S. Government Partners Update Warning of Iran-Affiliated Threat Actors Targeting Critical Infrastructure Programmable Logic Controllers](https://www.cisa.gov/news-events/news/cisa-fbi-epa-and-us-government-partners-update-warning-iran-affiliated-threat-actors-targeting)
- [Federal agencies broaden alert on Iran-linked OT attacks](https://therecord.media/federal-agencies-broaden-alert-on-iran-linked-ot-attacks)
- [CISA Urges Organizations to Remove Rockwell PLCs From Direct Internet Exposure](https://gbhackers.com/rockwell-plcs-removed/)
- [Iranian Hackers Infiltrate Siemens and Schneider PLCs, Blinding Operators With Fake Readings](https://www.techtimes.com/articles/321335/20260723/iranian-hackers-infiltrate-siemens-schneider-plcs-blinding-operators-fake-readings.htm)
- [(TLP:CLEAR) CISA Updates Iranian-Affiliated PLC Targeting Advisory (AA26-097A)](https://www.waterisac.org/tlpclear-cisa-updates-iranian-affiliated-plc-targeting-advisory-aa26-097a)
- [Iranian Threat Actors Continuing OT Attacks: Feds](https://www.isssource.com/iranian-threat-actors-continuing-ot-attacks-feds/)
- [Active Exploitation Alert: Iranian State-Sponsored Attacks Targeting Siemens, Schneider Electric, and Rockwell Automation ICS Devices](https://www.rescana.com/post/active-exploitation-alert-iranian-state-sponsored-attacks-targeting-siemens-schneider-electric-and-rockwell-automation-i)
- [Fake Bahrain Civil Defense App Deploys Android RAT to Steal PINs, OTPs, and Banking Credentials](https://cybersecuritynews.com/fake-bahrain-civil-defense-android-app/)
- [Fake Bahrain Alert App Deploys Android Surveillance Malware](https://www.darkreading.com/mobile-security/fake-bahrain-alert-apps-android-surveillance-malware)
- [Bahrain News: Fake alert app warning](https://www.gdnonline.com/Details/1401276/Fake-alert-app-warning)
- [Middle East Hack-for-Hire Operation Traced to South Asian APT Group](https://www.infosecurity-magazine.com/news/middle-east-hack-operation-bitter/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1659