Predatory Sparrow Group Targets Iran's Critical Infrastructure with Cyberattacks

Cybersecurity firm Picus Security has released an analysis of the group known as Predatory Sparrow, which is believed to be behind disruptive cyberattacks targeting Iran's critical infrastructure. The group has publicly claimed responsibility for several high-profile attacks against various sectors in Iran, including energy, government, and financial institutions.

Predatory Sparrow is recognized for its capacity to cause significant operational disruption and data destruction. Their activities strongly suggest affiliations with Israel, operating within the broader cyber shadow war between the two nations. Analysts believe the group aims to destabilize Iran and retaliate against its perceived cyber or geopolitical aggressions.

The report details the group's notable operations, including paralyzing Iran's national railway system and launching attacks on steel plants and financial entities. In December 2023, the group claimed to have disabled a significant portion of Iran's fuel pumps. In June 2025, they reported compromising Bank Sepah and cryptocurrency exchange Nobitex, alleging data destruction and the theft of $90 million in crypto assets.

Picus Security highlights that the group's tactics, techniques, and procedures (TTPs) reveal their capability to conduct complex and destructive operations. The company offers tools to simulate similar attacks and test defensive capabilities.