Threat Actor Characterization
Mr Soul
ID: 1f5fd004e2bc3bbfb90dfe63b705316398875| Mr_S0ull | Mr. Soll | Mr****** | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
2833df69906a2ea5d05283ca4f837bd432121 | CyberAv3ngers | Iran | affiliated | Cybercrime |
|
c81f42761d1b53a2d875a33ddfb8cdb764758 | Milad Mansuri | Iran | ally-of | Cybercrime |
|
8e1b51115cf9f23a27dc1e40755faace18409 | Reza Mohammad Amin Saberian | Iran | ally-of | Cybercrime |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Mr Soul is an online persona associated with the CyberAv3ngers ecosystem and publicly linked to IRGC-CEC-aligned malicious cyber activity against critical infrastructure. The persona is best assessed as a propaganda/coordination/operations-facing identity inside a wider OT/ICS targeting cluster rather than as a clearly independent actor.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1078.001 | Default Accounts | TA0001 TA0003 TA0004 TA0005 | |
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1491.001 | Internal Defacement | TA0040 | |
| T1565.001 | Stored Data Manipulation | TA0040 |
|
| T1095 | Non-Application Layer Protocol | TA0011 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
Mr Soul / Mr_S0ull / Mr. Soul — IRGC-linked CyberAv3ngers Online Persona
Classification: TLP:WHITE — Open Source Intelligence (OSINT)
Category: Cyber / State-linked Online Persona — Origin: Iran
Author: iQBlack CTI Team
Executive Summary
Mr Soul (also rendered publicly as Mr_S0ull or Mr. Soul, and in some reporting as Mr. Soll) is best assessed as an online persona associated with the CyberAv3ngers ecosystem, rather than a fully separate threat group with a clearly documented independent operational stack. Public U.S. government reporting links the persona to CyberAv3ngers malicious cyber activity against critical infrastructure and places that activity within the orbit of Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC).
The persona matters because it appears to sit at the intersection of operations, propaganda, and mobilization. Public reporting and public-sector notices tie CyberAv3ngers to compromises of exposed Unitronics PLC/HMI devices, anti-Israel defacement messaging, and later IOCONTROL-linked targeting of wider OT/IoT infrastructure. In parallel, third-party reporting described a separate “Mr Soul” Telegram channel used for recruiting or coordinating volunteer assistance, suggesting that the persona may have served as a front-facing operator or coordinator identity within the wider campaign structure.
Hunting Playbook — Mr Soul (CyberAv3ng3rs-related persona)
Priority: HIGH for water, wastewater, fuel management, manufacturing, energy, and other organizations operating internet-exposed OT/ICS assets or Israeli-/globally deployed vendor products named in CyberAv3ngers reporting. MEDIUM for enterprises whose exposure to the actor is indirect but whose internet-facing infrastructure could be used as a pivot into OT/IoT environments.
IOC Appendix — Mr Soul (CyberAv3ng3rs-related persona)
Scope & Caveats. This appendix reflects the best open-source picture available for the Mr Soul persona as of 2026-03-19T00:00:00Z. Public reporting most strongly supports using this appendix as a cluster-aware hunting aid for the CyberAv3ngers / IRGC-CEC ecosystem rather than as a standalone blocklist for one handle. Indicators below are therefore separated into high-confidence cluster-linked items, hunting-only patterns, and pseudo-IOCs / behavioral seeds. Where an item is based on broader CyberAv3ngers activity rather than uniquely on Mr Soul, that is stated explicitly.