Predatory Sparrow — Hacktivist Profile
A self-proclaimed hacktivist group that carried out attacks against Iranian railway systems and against Iranian steel plants.Also tracked as
Gonjeshke Darande, گنجشک درنده
Tools & malware
- HttpService backdoor
- Meteor wiper
- msdskint.exe wiper
- WinScreeny screenshot backdoor
Vendor research
- EvilPlayout: Attack Against Iran's State Broadcaster Check Point Research
- MeteorExpress | Mysterious Wiper Paralyzes Iranian Trains with Epic Troll SentinelOne (SentinelLabs)
- Deep dive into hack against Iranian state TV yields wiper malware, other custom tools CyberScoop
- Pro-Israel hackers hit Iran's Nobitex exchange, burn $90M in crypto BleepingComputer
- Predatory Sparrow's operations against Iranian financial cyber infrastructure (2025) CCDCOE (Cyber Law Toolkit)