Predatory Sparrow Strikes: Coordinated Cyberattacks Seek to Cripple Critical Infrastructure

A sophisticated cyber-sabotage group known as Predatory Sparrow has emerged as a leading threat to Iran’s critical infrastructure, pursuing highly disruptive campaigns rather than financial gain. The group first drew international attention in July 2021 when it compromised Iran’s national railway system, displaying the word “cyberattack” on station boards after deploying the Meteor wiper to render infected systems inoperable and erase forensic traces.

In June 2022, Predatory Sparrow claimed responsibility for an attack on an Iranian steel facility that caused a major fire and production shutdowns, marking a notable shift toward real-world damage. December 2023 saw a widespread disruption campaign against Iran’s nationwide gas station network, with most fuel pumps reportedly disabled and political messaging accompanying the operation.

The most recent and financially devastating operations occurred in June 2025, targeting Iran’s financial infrastructure, beginning with Bank Sepah and followed by Nobitex, where the group claimed to have burned about 90 million dollars in cryptocurrency and released the exchange’s complete source code and sensitive materials. Some analyses note security researchers widely believe the group operates with Israeli backing, highlighting the ongoing cyber shadow war between Israel and Iran.