Predatory Sparrow: cyber sabotage with a conscience?

Iran’s critical infrastructure has faced devastating cyberattacks in recent years, wreaking havoc on railway timetables and shutting down petrol stations. Behind these high-profile cyberattacks is a group known as Predatory Sparrow.

Predatory Sparrow’s origins and identity are uncertain. The group claims it is a hacktivist force, defending Iran’s citizens against the ‘aggression of the Islamic Republic’ through targeted cyber operations. Yet its tactics are anything but grassroots, suggesting a level of coordination, skill, and resources uncommon among independent activist groups. While some have suggested that the group may be linked to Israel, there is no conclusive evidence in the public domain. 

Predatory Sparrow’s track record

Since mid-2021, Predatory Sparrow has been targeting Iran’s critical infrastructure. Each incident appears to be chosen to maximise visibility and embarrassment for the Iranian regime.

The first major attack, in July 2021, targeted Iran’s Ministry of Roads and Urban Development. Using a customisable wiper malware later dubbed ‘Meteor’, Predatory Sparrow disrupted train schedules, resulting in chaos in stations as commuters faced unanticipated delays and cancellations. Digital information boards and affected computers displayed the digits ‘64411’, directing frustrated passengers to call Supreme Leader Ayatollah Ali Khamenei’s office – a symbolic jab at the heart of the regime.

In October 2021, Predatory Sparrow launched another attack, this time against Iran’s network of petrol stations. The operation temporarily disabled state-subsidised fuel smart cards, leaving drivers stranded in long queues, unable to access discounted fuel. This attack also incorporated the ‘64411’ number, underscoring the group’s intent to maximise disruption and aim public dissatisfaction toward Khamenei.

Predatory Sparrow struck again in January 2022, this time with a 10-second interruption to Iran’s state-run television network. An inserted clip called for the death of the Supreme Leader and displayed images of leaders of the Mujahedin E-Khalq (MEK), a longstanding anti-regime group. This bold move showcased the group’s access to state media and gave airtime to one of the regime’s main opponents.

Perhaps their most audacious attack occurred in June 2022, when Predatory Sparrow reportedly caused a failure in a steel plant in the province of Khuzestan, in southwest Iran. This cyber operation is significant for its physical impact: reports suggest that machinery in the facility malfunctioned, endangering workers on site. 

Most recently, in December 2023, Predatory Sparrow again disrupted Iran’s fuel distribution system, reportedly affecting nearly 70% of the country’s petrol stations. This second attack on the fuel network solidified the group’s focus on targeting infrastructure central to the daily lives of Iranians.

Murky origins

Predatory Sparrow presents itself as a retaliatory hacktivist group, striking back against the ‘aggression of the Islamic Republic’. It maintains a strong online presence, with an account on X (formerly Twitter) under its Persian name, Gonjeshke Darande, and a regularly updated Telegram channel. Predatory Sparrow’s actions are frequently picked up by international media, especially Israeli outlets and Iranian opposition channels like Iran International.

Yet the group’s methods and choices of targets paint a more complex picture. Hacktivist groups often engage in online protests or data breaches to further social or political agendas, but Predatory Sparrow uses customised ‘wiper’ malware (which deletes or overwrites data on target devices and networks, rendering them unusable) and targets physical infrastructure in ways more typical of state-sponsored groups. Other prolific hacktivist groups in Iran, such as Edalat-e Ali – so far not linked to Predatory Sparrow – have stayed with more traditional hack-and-leak operations, albeit with high-profile targets ranging from the judiciary to maximum security prisons.

Predatory Sparrow’s operations showcase technical proficiency beyond that of a typical hacktivist group, indicative of advanced training and resources. This assessment has led to suggestions that Predatory Sparrow may only be ‘maintaining the veneer’ of a hacktivist group, acting instead as a proxy for a state. Their strategic target selection and precise internal coordination also suggest a calculated approach akin to government hacking groups, not independent hacktivists. 

Predatory Sparrow’s use of wiper malware mirrors Iran’s own techniques. Iranian wiper attacks have long caused havoc in its neighbouring states – and occasionally the US – and were in turn developed after a US-attributed wiper, linked to the ‘Flame’ worm, affected Iranian oil infrastructure back in 2012.

Finally, there are some indications that Iran views the MEK as connected to Predatory Sparrow. In July 2022, Iran is thought to have launched a wiper attack on the government of Albania, where the MEK is based. The attack was accompanied by a picture of an eagle swooping down on Predatory Sparrow’s distinctive cartoonish logo, set inside a star of David. As this cyberattack was almost certainly directed at the MEK, the image brings Predatory Sparrow – and Israel – into the frame, although we should be careful about inferring too much from such breadcrumbs.

Ethical constraints on cyber operations?

Predatory Sparrow publicly upholds an ethical stance, asserting that its operations are carefully conducted to avoid harm to ‘innocent individuals.’

However, this moral framing clashes with the group’s choice of targets and real-world impact. The steel plant incident in June 2022, for example, pushed the boundaries of hacktivism into the realm of cyber-physical sabotage. Surveillance footage from the attack showed machinery malfunctioning and spewing fire and molten steel, with two workers narrowly escaping harm. 

In justifying its actions, Predatory Sparrow portrayed the attack as a strike against companies that flout international sanctions. The group also explained that the attack was timed for the early morning (5:15 am) to minimize risks. Iran does not have enough energy to keep steel plants running constantly, so they operate at reduced capacity during off-peak hours. Interestingly, Predatory Sparrow said they could have caused more severe damage but chose not to for ethical reasons.

It is useful to briefly contrast Predatory Sparrow’s approach to restraint with that of the most (in)famous cyberattack targeting Iran: Stuxnet. Stuxnet was carefully designed to cause disruption only to specific uranium enrichment facilities, leading some observers to suggest the code had undergone extensive legal review, and therefore exemplified ‘responsible’ cyber operations. Predatory Sparrow’s account of their decision-making points to similar concerns of precision, although the credibility of their self-reported ethics is limited. 

New questions of strategy and ethics

The understudied actions of Predatory Sparrow therefore raise two main questions – and research avenues – for the cybersecurity community. 

First, how much political change can cyber-physical disruption truly generate in authoritarian regimes? Can Predatory Sparrow fulfil its aim of bringing down the government? In more open, democratic states, major incidents generate severe political pressure – think of former US President Barack Obama’s response to the Sony Pictures hack, or the UK’s response to the Wannacry ransomware attack. However, we have little sense of how these pressures translate to authoritarian countries like Iran. Undemocratic states have much greater control over the information environment, an extensive repressive apparatus, and little or no incentive to encourage accurate reporting of the impact of a cyber incident. 

Second, how do concepts or responsibility and ethics apply to offensive cyber operations? Debates about responsible cyber operations typically contrast two stereotypical positions. The first, exemplified by Stuxnet, involves state legal and technical authorities thoroughly reviewing ‘by-the-book’ operations. The second, like the 2017 NotPetya ransomware attack that affected countries around the world, involves state actors or proxies (such as cybercriminal groups and hacktivists) conducting ‘reckless’ operations with little concern for legal niceties. Predatory Sparrow fits into neither mould, blending hacktivist recklessness with measured concern for collateral damage and proportionality. 

Overall, despite its professed ethical restraint, Predatory Sparrow’s operations clearly violate peacetime norms of cyber operations, developed over decades and agreed in various UN forums. Of course, Iran is not in peacetime, and Predatory Sparrow’s operations must be seen in the context of growing regional conflict. They also occurred alongside the 2022 Mahsa Amini protests and subsequent violent repression. Deeper analysis of this group would help us understand the potential for cyber operations to widen existing cracks of frustration and anger in authoritarian regimes, as well as how far such operations are subject to ethical or strategic constraints.