Predatory Sparrow (Farsi: Gonjeshke Darande) is a highly sophisticated hacking group known for executing politically motivated cyberattacks against Iranian targets. The group is widely reported to have links to Israel, though the Israeli government has never officially acknowledged any connection.
Notable Operations
Nobitex Crypto Exchange Hack (June 2025)
• Predatory Sparrow claimed responsibility for hacking Nobitex, Iran’s largest cryptocurrency exchange, siphoning and destroying nearly $90 million in various cryptocurrencies. The funds were sent to blockchain wallets with anti-government slogans and then irreversibly burned, signaling a political rather than financial motive.
• The group accused Nobitex of helping the Iranian government evade sanctions and fund militant groups.
• Following the hack, Predatory Sparrow also released the exchange’s source code, exposing further vulnerabilities.
Bank Sepah Attack (June 2025)
• Just before the Nobitex breach, the group claimed to have destroyed data at Iran’s state-owned Bank Sepah, targeting the institution for allegedly financing Iranian military operations.
Past Attacks
• 2021: Attributed with a cyberattack that paralyzed gas stations across Iran.
• 2022: Claimed responsibility for an attack on an Iranian steel mill that caused a significant fire and physical damage, an incident rare for its real-world impact.
Tactics and Motivations
• Political Messaging: Predatory Sparrow’s operations are characterized by their overt political messaging, often targeting institutions linked to the Iranian regime or its military apparatus. Their attacks are designed to disrupt, embarrass, and weaken the Iranian state, especially in the context of ongoing conflict and sanctions.
• Destructive Techniques: The group has a track record of not just stealing data or funds but also destroying them—either by wiping data or burning cryptocurrency assets—making recovery impossible and maximizing disruption.
• Public Disclosure: They often publicize their exploits on social media, sometimes leaking stolen data or source code to further damage their targets and expose vulnerabilities