Inside a New OT/IoT Cyberweapon: IOCONTROL

In December 2024, we uncovered a sophisticated global cyberwarfare campaign deploying IOCONTROL, a modular malware attributed to Iranian threat actors, targeting IoT and OT systems. This malware exhibits a modular architecture, enabling it to compromise devices across multiple Linux based platforms, including ARM (LE and BE), MIPS, x86, and more. It is capable of infiltrating a wide range of device types, such as PLCs, gas pump controllers, routers, firewalls, IP cameras, and others.

In this presentation, Sharon will provide a deep dive into the technical aspects of his static and dynamic reverse engineering efforts, including the emulation of embedded environments to enable comprehensive real-time analysis. Additionally, Sharon will explore the malware’s stealth strategies, such as leveraging MQTT protocol for command-and-control (C2) operations, DNS-over-HTTPS for communication obfuscation, and its ability to remotely control the embedded compromised devices. Finally, we will discuss the impact on the victims’ devices and how the campaign was ultimately disrupted.