Predatory SparrowThreat actor
- gonjeshke darande
- indra
A self-proclaimed hacktivist group that carried out attacks against Iranian railway systems and against Iranian steel plants.From MISP Galaxy
Last reported 3 months ago, by SentinelLabs2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1195Supply Chain Compromise
“A compromised supplier may expose customer identities and trusted administrative paths, but it’s only a software supply-chain compromise if there is evidence that downstream customers, builds, updates, or distribution were affected.”
- T1505.003Web Shell
“These illegal marketplaces provide pre-compromised CMS access or web shells, removing the need for attackers to breach these systems themselves.”
- T1684Social Engineering
“Espionage via recruitment-themed social engineering, aligned with IRGC strategic priorities”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters“Predatory Sparrow is an obvious comparison given prior high-impact operations against Iranian financial targets, but on the available evidence it is not an attribution.”
-
Middle East Cyber Escalation: From Hacktivism to Sophisticated Threat Operations“On June 18, the threat actor Predatory Sparrow claimed responsibility for compromising Nobitex, a prominent Iranian cryptocurrency exchange.”
Indicators in its reports
named in the reports above- airframes[.]ioin 1 report
Copy this indicator · defanged
Thanks — we review every report.