Unitronics Defacement Campaign
Campaign · ATTACK:ics:C0031
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:C0031",
"title": "Unitronics Defacement Campaign",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0031",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--8fda050f-470d-4401-994e-35c1a6c301de",
"external_id": "C0031",
"domain": "ics",
"created": "2024-03-25T19:58:53.090Z",
"modified": "2026-07-31T20:48:17.564Z",
"version": "1.0",
"aliases": [
"Unitronics Defacement Campaign"
],
"tactics": [
],
"source_references": [
{
"source_name": "CISA AA23-335A IRGC-Affiliated December 2023",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a"
},
{
"source_name": "Frank Bajak and Marc Levy December 2023",
"url": "https://apnews.com/article/hackers-iran-israel-water-utilities-critical-infrastructure-cisa-554b2aa969c8220016ab2ef94bd7635b"
},
{
"source_name": "Lisa Zahner December 2023",
"url": "https://veronews.com/2023/12/15/hackers-in-iran-attack-computer-at-vero-utilities/"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:C0031 → uses → ATTACK:ics:T0826
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1673b2e2-7799-4b5f-b5a9-2c51426a6916
Jamie Tarabay and Katrina Manson December 2023ATTACK:ics:C0031 → uses → ATTACK:ics:T0814
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18ab56e8-79ce-481d-9ab4-e558fbfb5ac5
CISA AA23-335A IRGC-Affiliated December 2023 · CISA Unitronics November 2023 · Frank Bajak and Marc Levy December 2023 · Jamie Tarabay and Katrina Manson December 2023 · WPXI Aliquippa Water November 2023ATTACK:ics:C0031 → uses → ATTACK:ics:T0829
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69889c90-e6d0-4007-9078-2bfbd7c18a91
CISA AA23-335A IRGC-Affiliated December 2023 · Jamie Tarabay and Katrina Manson December 2023ATTACK:ics:C0031 → uses → ATTACK:ics:T0883
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b0e8f60-ecdf-4140-9741-5b50df67353c
CISA AA23-335A IRGC-Affiliated December 2023 · Lisa Zahner December 2023ATTACK:ics:C0031 → attributed-to → ATTACK:ics:G1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a55e351-d3b7-460a-9a9d-6714c00db5f0
CISA AA23-335A IRGC-Affiliated December 2023ATTACK:ics:C0031 → uses → ATTACK:ics:T1694.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aabf71ab-4121-4e3e-888d-cc16d2133846
CISA AA23-335A IRGC-Affiliated December 2023 · CISA Unitronics November 2023ATTACK:ics:C0031 → uses → ATTACK:ics:T0828
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d67ae959-9014-4501-b963-42bee03a5e3b
Jamie Tarabay and Katrina Manson December 2023