Predatory ⁢Sparrow Hackers Wage Cyberwar on Iran’s Financial System

⁢ Updated June 23, 2025
⁢ ⁤

The hacking group Predatory Sparrow, long ⁣suspected of ties to Israeli intelligence, has turned its attention to Iran’s financial sector, marking an escalation in the ongoing cyberwar between the two nations.The group, known for its aggressive tactics and complex attacks, has previously targeted critical infrastructure in Iran, including railways and⁣ gas stations.

Crypto tracing confirms that Nobitex, an Iranian crypto exchange, has links to sanctioned entities, including the Islamic⁣ Revolutionary Guard⁣ Corps (IRGC), Hamas, ⁤Houthi rebels in Yemen, and⁣ Palestinian Islamic Jihad. Robinson said the attack on Nobitex is an ‍act of ⁤sabotage, targeting a key financial institution ⁤used by Iran to evade sanctions.

Predatory Sparrow’s past attacks include data-destroying operations against Iran’s railways and disabling payment systems at gas stations, causing nationwide fuel shortages. In 2022, the group executed a‍ destructive cyberattack on the Khouzestan steel mill, ‍causing molten steel ⁤to spill and setting the plant ⁢ablaze.

John Hultquist, chief analyst at Google’s ⁢threat intelligence group, notes that the reason for Predatory Sparrow’s ⁣focus on the financial sector remains unclear. He suggests it⁢ might very well be due to the perceived importance of these institutions or their vulnerability to cyberattacks.hultquist added that Predatory sparrow’s involvement‍ suggests more serious cyber activity is highly likely.

⁢ “This actor is very serious and⁤ very capable, and that’s what separates them from manny of ⁣the operations that we’ll probably see in the coming‍ weeks ⁣or months,” Hultquist said. “A lot of actors are going to make threats. This is one that can follow through on those threats.”

What’s next

the cyber landscape between Iran and its⁤ adversaries⁢ remains tense, with⁤ potential for further attacks on critical infrastructure and financial institutions. Experts anticipate continued cyber activity ‍from various actors, including hacktivists and state-sponsored groups.