{"id":3039,"date":"2026-01-28T18:25:24","date_gmt":"2026-01-28T17:25:24","guid":{"rendered":"https:\/\/lab52.io\/blog\/?p=3039"},"modified":"2026-02-04T13:14:54","modified_gmt":"2026-02-04T12:14:54","slug":"black-industry-irgc-linked-offensive-ot-framework","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/black-industry-irgc-linked-offensive-ot-framework\/","title":{"rendered":"Black Industry: IRGC-Linked offensive OT framework"},"content":{"rendered":"\n

Actor Background and Tool Distribution<\/strong><\/h2>\n\n\n\n

A new offensive OT framework<\/strong> has been identified and offered for sale on a platform accessible via the TOR network, promoted by the “APT IRAN” channel<\/strong>. The administrators have indicated that this is the most extensive industrial and military control network framework<\/strong> to date within the Black Industry (BI) ecosystem.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

The tool can be purchased through the TOR network and is being promoted in a portal called \u201cBlack Market Cartel\u201d<\/strong>; however, the published purchase link<\/a> <\/a>seems currently broken. The day before the message was posted, APT Iran stated that they would release a demo primarily focused on \u201cthe insecurity of the United States of America.\u201d<\/strong><\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

The site hosts the promotion and sale of an alleged offensive framework targeting critical, industrial, and military infrastructure (OT).<\/strong><\/a><\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

APT Iran is closely linked to CyberAv3ngers<\/strong>, to the point where it is widely believed to be a rebranding of this hacktivist group, as much of their activity overlaps. The message in the following image translates to, \u201cIf the channel is blocked, follow us via an alternative link.\u201d<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

CyberAv3ngers, in turn, is closely linked to the Islamic Revolutionary Guard Corps (IRGC)<\/strong>. United States intelligence agencies document<\/a> that the group works closely with an IRGC Cyber \u200b\u200bCommand (IRGC-CEC). It is worth noting that there are even some sources who claim that APT Iran is, in essence, a subdivision of the IRGC-CEC.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n
\n\n\n\n

It is important to note that on January 26, 2026, the “APT Iran” channel was deleted, along with most prior mentions of Black Industry on Telegram<\/strong>. In contrast, a new Telegram channel called \u201cCyber4vengers\u201d has been created.<\/strong><\/p>\n\n\n\n

<\/p>\n\n\n\n

Identified Capabilities<\/strong><\/h2>\n\n\n\n

The following is a list of the tools and modules explicitly mentioned in the web page<\/strong>, detailing their functionalities according to the promotional text and visible system logs. The information gathered from the images and descriptions on the website was used to comment on the capabilities.<\/p>\n\n\n\n

ADV-PLATFORM-01 (Security Assessment Framework)<\/h3>\n\n\n\n

This is the only tool marked as “AVAILABLE FOR PURCHASE”.<\/p>\n\n\n\n

General purpose:<\/strong> Advanced platform for identifying, monitoring, and analyzing risks to industrial and military infrastructure.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

Technical capabilities:<\/strong><\/p>\n\n\n\n

    \n
  • Network scan<\/li>\n\n\n\n
  • Multi-Protocol Analisys<\/li>\n\n\n\n
  • Security Engine<\/li>\n\n\n\n
  • Exploiter<\/li>\n\n\n\n
  • Industrial<\/li>\n\n\n\n
  • Security<\/li>\n\n\n\n
  • Monitoring<\/li>\n\n\n\n
  • Reports<\/li>\n\n\n\n
  • Settings<\/li>\n<\/ul>\n\n\n\n

    The logs load modules that suggest OT and other IT-specific scanning and exploitation capabilities<\/strong> such as:<\/p>\n\n\n\n

      \n
    • Exploiter Repeater: Burp-style ready. This suggests the ability to intercept and manually resend packets (Replay attacks) similar to Burp Suite, but focused on industrial protocols.<\/li>\n\n\n\n
    • Multi-Protocol Scanning: Loaded support for Modbus, S7comm, Ethernet\/IP, OPC UA.<\/li>\n<\/ul>\n\n\n
      \n
      \"\"<\/figure><\/div>\n\n\n
        \n
      • CCTV Recognition: Specific detection module for IP cameras from Hikvision, Dahua and Axis brands.<\/li>\n\n\n\n
      • Vulnerability Engine (CVE): The system status displays SECURITY ENGINE: CVE Analysis Ready, suggesting an integrated database of known vulnerabilities.<\/li>\n<\/ul>\n\n\n\n

        In addition, it is stated that it has the following Operational Capabilities:<\/p>\n\n\n\n

          \n
        • Zero-Footprint: Designed to leave no forensic traces on compromised systems.<\/li>\n\n\n\n
        • Air-Gap Penetration: Refers to specialized modules for physically isolated systems.<\/li>\n\n\n\n
        • Mission Impact Analysis: Mapping the attack surface based on mission criticality (not just open ports).<\/li>\n<\/ul>\n\n\n\n

          ICS-001 (PLC Persistence Module)<\/h3>\n\n\n\n

          Marked as LOCKED \/ COMING SOON. Access requires “Level 5 Clearance”. The method for increasing clearance is unknown, though it likely depends on earning the group\u2019s trust.<\/p>\n\n\n\n

            \n
          • General purpose:<\/strong> Implementation of firmware-level backdoors in Programmable Logic Controllers (PLCs).<\/li>\n\n\n\n
          • Target Platforms:<\/strong> Siemens S7, Allen-Bradley, and Schneider Electric.<\/li>\n\n\n\n
          • Protocols:<\/strong> S7COMM, CIP, MODBUS.<\/li>\n<\/ul>\n\n\n
            \n
            \"\"<\/figure><\/div>\n\n\n

            ICS-002 (SCADA Deception Suite)<\/h3>\n\n\n\n

            Marked as LOCKED \/ COMING SOON. Accessible only with “Level 6 Clearance”.<\/p>\n\n\n\n

              \n
            • General purpose<\/strong>: Real-time manipulation of HMI (Human-Machine Interface) and data injection.<\/li>\n\n\n\n
            • Evasive Capability<\/strong>: Designed to bypass commercial intrusion detection systems (IDS\/IPS).<\/li>\n\n\n\n
            • Protocols<\/strong>: OPC UA, DNP3, IEC 60870.<\/li>\n<\/ul>\n\n\n
              \n
              \"\"<\/figure><\/div>\n\n\n

              ICS-003 (Grid Control Framework)<\/h3>\n\n\n\n

              Marked as LOCKED \/ COMING SOON. Accessible only with “Level 7 Clearance”.<\/p>\n\n\n\n

                \n
              • General purpose<\/strong>: Precise manipulation of electrical distribution systems.<\/li>\n\n\n\n
              • Functionalities<\/strong>: Selective circuit control, load balancing disruption, and equipment stress testing.<\/li>\n\n\n\n
              • Protocols<\/strong>: IEC 61850, IEC 61970.<\/li>\n<\/ul>\n\n\n
                \n
                \"\"<\/figure><\/div>\n\n\n

                <\/p>\n\n\n\n

                Conclusions<\/strong><\/h2>\n\n\n\n

                It cannot be confirmed that the tool\u2019s web resource is not a honeytoken-style decoy designed to identify potential adversaries, several factors suggest it is a functional tool. These include its hosting on an onion network<\/strong>, its publication by the APT Iran group<\/strong>, which is linked to the IRGC<\/strong>, the level of detail provided in the tool\u2019s description<\/strong> and the removal of its sale from the internet<\/strong>. Collectively, these elements indicate that the tool is actively used by hacktivist groups <\/strong>and nation-linked actors<\/strong> associated with Iran, demonstrating that this group\u2019s capabilities and organizational structure are more sophisticated than previously expected.<\/p>\n\n\n\n

                Finally, although the goals behind this sale are unknown, the tool may be intended to support the group\u2019s financial objectives<\/strong>. It is, however, more likely motivated by other considerations, such as obstructing attribution<\/strong> or contributing to broader destabilization efforts.<\/strong><\/p>\n\n\n\n

                <\/p>\n","protected":false},"excerpt":{"rendered":"

                Actor Background and Tool Distribution A new offensive OT framework has been identified and offered for sale on a platform accessible via the TOR network, promoted by the “APT IRAN” channel. The administrators have indicated that this is the most extensive industrial and military control network framework to date within the Black Industry (BI) ecosystem. […]<\/p>\n","protected":false},"author":30,"featured_media":3057,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1],"tags":[4,87,89,88],"class_list":{"0":"post-3039","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-uncategorised","8":"tag-apt","9":"tag-hacktivism","10":"tag-iran","11":"tag-irgc","12":"entry"},"featured_image_src":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2026\/01\/black_ind_lab52-copia-600x400.png","featured_image_src_square":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2026\/01\/black_ind_lab52-copia-600x487.png","author_info":{"display_name":"Dio","author_link":"https:\/\/lab52.io\/blog\/author\/dio\/"},"_links":{"self":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/3039"}],"collection":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/users\/30"}],"replies":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/comments?post=3039"}],"version-history":[{"count":8,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/3039\/revisions"}],"predecessor-version":[{"id":3059,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/3039\/revisions\/3059"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media\/3057"}],"wp:attachment":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media?parent=3039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/categories?post=3039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/tags?post=3039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}