Predatory Sparrow
Attribution profile
- Type
- Activist
- Location
- Israel
- Known incidents
- 9 incidents
- Sources
- 3 sources
- First seen
- 2022-06-27
- Last seen
- 2025-06-18
- Updated
- 2026-10-24 06:03
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Predatory Sparrow, also known as Gonjeshke Darande, is a pro‑Israel hacking group assessed to operate from Israel. The group has repeatedly targeted Iranian entities across sectors including cryptocurrency exchanges, banking, maritime ports, fuel distribution and steel manufacturing, framing its operations as political retaliation against the Iranian regime and its regional activities. In the June 2025 attack on an Iranian crypto exchange the group claimed responsibility for unauthorized access that drained hot‑wallet assets worth approximately $81.7 million, describing the theft as a political statement and threatening further leaks. A June 2025 intrusion into Bank Sepah disrupted customer services, account access, withdrawals and card payments, with the group saying it was retaliation for the bank’s alleged financing of Iran’s military and nuclear programs. The May 2025 cyberattack on an Iranian port was described by foreign officials as highly accurate and causing more damage than Iranian officials acknowledged, and was linked by Israeli officials to an earlier attempted cyberattack on Israeli water infrastructure. In December 2023 the group claimed a controlled cyberattack that disrupted fuel services at roughly 70 % of Iran’s petrol stations, forcing manual operations while asserting the strike avoided emergency‑service impacts. The June 2022 intrusion into Khouzestan Steel Company involved compromise of HMIs, network diagrams and CCTV systems, exfiltration of footage and a public video showing machinery disruption; analysts noted the intrusion leveraged typical OT weaknesses such as insufficient network segmentation, outdated systems and lack of intrusion detection enabling lateral movement. Public attribution consistently ties the group to Israel, with Iranian officials and state media accusing it of links to the Israeli government, while the group itself identifies as pro‑Israeli.
Incidents
Attributed incidents are available to members.
9 incidentsSources
Sources available to members: 3 sources.