The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The U.S. State Department’s Rewards for Justice program is offering up to $10 million for information that helps identify or locate people who, under the direction or control of a foreign government, conduct malicious cyber activity against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. The offer is tied to Iranian-affiliated cyber activity, including attacks on industrial control systems (ICS) and operational technology (OT); it is a maximum reward, not a guaranteed payment for any tip.
What the $10 million reward covers
The State Department’s Rewards for Justice (RFJ) program describes the reward as being for information leading to the identification or location of people involved in qualifying foreign-government-directed cyber activity against U.S. critical infrastructure. Its separate tip page advertises a reward of up to $10 million for information on Iranian hackers affiliated with Iran’s Ministry of Intelligence and Security and the Islamic Revolutionary Guard Corps (IRGC). The reward language is limited by those conditions; it is not a general bounty for reporting malware or finding a vulnerable device.
RFJ’s CyberAv3ngers profile names six officials associated with the IRGC Cyber-Electronic Command (IRGC-CEC):
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Hamid Homayunfal
- Hamid Reza Lashgarian
- Mahdi Lashgarian
- Milad Mansuri
- Mohammad Bagher Shirinkar
- Mohammad Amin Saberian
RFJ provides official tip channels, but the available program description does not establish a guaranteed award amount or promise that every submission will qualify.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What IOCONTROL is and what it targets
RFJ describes CyberAv3ngers as affiliated with the IRGC-CEC and says the group used IOCONTROL against industrial-control and SCADA devices around the world. SCADA systems supervise industrial processes; ICS and OT include the controllers and equipment that monitor or operate those processes. The profile names routers, programmable logic controllers (PLCs), human-machine interfaces (HMIs), firewalls, IP cameras, and Linux-based IoT, SCADA, and OT platforms as targets.
Vendors named in the RFJ profile include Baicells, D-Link, Hikvision, Red Lion, Orpak, Phoenix Contact, Teltonika, and Unitronics. The profile does not mean that every device from those vendors is compromised or that every product is affected in the same way.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
The Unitronics PLC incidents
RFJ says that, since at least November 22, 2023, actors compromised Unitronics Vision PLCs in the United States by using default credentials. The devices were used in water and wastewater, energy, food and beverage, manufacturing, healthcare, and other industries. The actors left threatening messages on device screens, and the compromise could render a device inoperative.
Recommended Free Tools
Which U.S. sectors agencies say have been targeted
A joint CISA, FBI, EPA, and partner update published July 22, 2026 says Iranian-affiliated actors targeted internet-connected OT devices and expanded observed targeting to PLCs from Rockwell Automation, Schneider Electric, Siemens, and possibly other manufacturers. Agencies reported attempts to download malicious project files and manipulate HMI/SCADA displays, with operational disruption and financial loss in water and wastewater, energy, and government services.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
A separate CISA, FBI, DC3, and NSA fact sheet dated June 30, 2025 described the November 2023–January 2024 campaign against Israeli-made PLCs and HMIs. It reported dozens of U.S. victims across water and wastewater, energy, food and beverage manufacturing, healthcare, and public-health sectors. The dates and sector lists refer to reported campaigns and affected environments; they are not a forecast that every facility in those sectors will be attacked.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How organizations can reduce PLC and OT exposure
The federal guidance points to internet exposure, weak or shared credentials, outdated software, and known vulnerabilities as recurring risks. CISA, FBI, EPA, and partners recommend reviewing manufacturer guidance, controlling access to PLCs, checking project files for unauthorized changes, and ensuring service providers know about active threats. The measures below translate those recommendations into operational checks; implementation should account for safety and vendor requirements.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
| Control area | What to do | Why it matters |
|---|---|---|
| Internet exposure | Identify PLCs and other OT devices reachable from the public internet. Restrict access to authorized networks and users, and segment OT from business and external networks where feasible. | Agencies warn about exposed OT systems and specifically recommend strict control of network access to PLCs. |
| Credentials | Replace default or common passwords with unique, managed credentials. Review who and what can authenticate to each device. | The Unitronics incidents involved compromised default credentials; the 2025 fact sheet also cites default or common passwords as a weakness. |
| Software and vulnerabilities | Track device software versions, review manufacturer security guidance, and address known vulnerabilities and outdated software through a change process that accounts for operational safety. | The 2025 joint fact sheet says actors exploit unpatched or outdated software and known CVEs. |
| PLC project integrity | Keep an authorized baseline of PLC project files and validate files for unauthorized changes before deployment or restoration. | The July 2026 agency update reports attempts to download malicious project files and recommends validating PLC project files. |
| Monitoring and response | Watch for unexpected access, project-file changes, or altered HMI/SCADA displays. Define how operators will verify unusual changes and escalate suspected compromise. | Agencies reported attempts to manipulate displays and cause disruption, making integrity checks and a response path relevant safeguards. |
| Vendors and service providers | Review the relevant manufacturer’s guidance and ensure integrators, maintenance contractors, and other service providers are aware of active threats and approved access practices. | The July 2026 update explicitly recommends reviewing manufacturer guidance and informing service providers. |
Cyberattacks are only one part of the reported activity
Iran-linked activity described by U.S. authorities also includes disruptive influence operations. On March 19, 2026, the Department of Justice said four domains linked to Iran’s Ministry of Intelligence and Security were used for destructive or disruptive attacks, data theft, doxxing, death threats, and “faketivist” psychological operations. DOJ reported that a Handala-linked domain claimed a March 2026 destructive malware attack against a U.S. medical-technology firm, while another domain posted sensitive information about approximately 190 people associated with the Israeli Defense Force or Israeli government.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Those operations are distinct from the IOCONTROL activity against industrial devices, even though both are discussed in the broader context of Iranian-affiliated cyber activity. The DOJ account describes claims and activity associated with the domains; it should not be read as evidence that IOCONTROL was used in those incidents.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
