Cybersecurity researchers have identified a new form of malware linked to an Iranian threat actor that targets IOT and OT/SCADA systems used by critical infrastructure in Israel and the United States. Dubbed IOCONTROL, the malware targets devices including routers, programmable logic controllers (PLCs), and fuel management systems among others. IOCONTROL is allegedly linked to CyberAv3ngers, an Iranian hacking group known for attacking industrial control systems. IOCONTROL has been found in Gasboy and Orpak fuel management system infections, although it is unknown how the malware was planted on the systems. The malware is stored in the “/usr/bin/” directory as “iocontrol” and uses a script “S93InitSystemd.sh” to maintain persistence on the infected device. IOCONTROL uses MQTT protocol for command-and-control communications (C2) and resolves C2 domains via DNS over HTTPS. The malware is capable of reporting system details, running OS commands, self-deleting, and running port scans. Once installed in a fuel management system, IOCONTROL could control pumps or payment terminals, leading to disruption of services and potentially data theft. Researchers note that the malware’s modular nature makes it capable of compromising many different types of devices. Threat actors claimed to have compromised 200 gas stations in Israel and the U.S. on Telegram last year and researchers report that new campaigns have emerged this year. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.