A profile of Israel-linked Predatory Sparrow, whose cyberattacks of Iranian civilian targets are some of the most aggressive offensive hacking incidents ever
From repeatedly crippling thousands of gas stations to setting a steel mill on fire, Predatory Sparrow's offensive hacking … Mastodon: @simontsui@infosec.exchange and @agreenberg@infosec.exchange X: @a_greenberg , @soheilsec , and @cecalli_helper Mastodon: Simon / @simontsui@infosec.exchange : WIRED reports on Israeli-aligned threat actor Predatory Sparrow, who have been linked to attacks on 3 Iranian steelworks, Iran's railway system computers, and payment systems affecting Iran's gas station pumps (twice). This article is a summary of known Predatory Sparrow incidents in the backdrop of the Israel-Hamas War and rising tensions in the Middle East. … Andy Greenberg / @agreenberg@infosec.exchange : Israel-linked hacker group Predatory Sparrow has carried out some of the most disruptive hacking of civilian targets ever. Yet they also claim to limit their cyberattacks' harm. I dug into the recent history of this hyper-aggressive, contradictory player in cyberwar. — https://www.wired.com/... X: Andy Greenberg / @a_greenberg : That contradiction is captured in an insane clip from a video the hackers posted from their destructive attack on a steel mill in Iran. The hackers wrote that it was “carried out carefully so to protect innocent individuals.” But you can see two workers narrowly escaping death. [video] Soheil / @soheilsec : گنجشک درنده(اسرائیل) از 2021 تا الان 2021: Train Chaos 2021: Gas Station Paralysis 2022: Steel Mill Meltdown 2023: Gas Station Paralysis, Redux https://www.wired.com/... @cecalli_helper : “any suggestion of restraint or discrimination from a hacker group that likely has Israeli government ties warrants skepticism.” https://www.wired.com/... Sparrow CyberWar @Law4Palestine @AliAbunimah @Palestine_UN @CIJ_ICJ @IntlCrimCourt @AlJazeera @OnlinePalEng
Context & Ripple Effects
This profile consolidates a campaign pattern already visible in coverage of fuel-system attacks that disrupted daily life in Iran: cyber operations aimed not only at data or espionage, but at services civilians use. Related reporting also described the wider Iran-Israel contest as increasingly public and disruptive to infrastructure.
The incidents matter because they connect payment systems, rail operations and industrial control environments in one escalation arc. A later claimed disruption at Bank Sepah suggests financial services remained a relevant target category within that arc.
First-order effects
- Iranian civilians and businesses face immediate service interruptions when payment, transport or industrial systems are targeted; gas-station outages directly prevent fuel purchases.
- Operators of Iranian critical infrastructure must treat network compromise as a physical-safety and continuity risk, particularly after the reported steel-mill fire.
Second-order effects
- Repeated civilian-facing disruption raises the cost of operating and restoring Iranian payment and infrastructure networks, pushing defenders to prioritize segmentation, recovery procedures and manual fallbacks.
- The visible impact of these operations intensifies reciprocal cyber pressure: related coverage describes a more public cyber conflict affecting civilian life on both sides, increasing the likelihood that adjacent civilian services are drawn into retaliation.
Third-order effects
- If this pattern persists, the boundary between state conflict and civilian infrastructure will continue to erode, with cyber operations functioning as coercive tools below the threshold of conventional military action.
- Publicly attributed or claimed attacks can make cyber campaigns part of political signaling as well as sabotage, complicating deterrence because governments must respond to both operational damage and public confidence effects.
The trend: The story is one data point in the normalization of cyber conflict as a visible, civilian-facing instrument of regional state competition.