19. June 2025
Mysterious Israeli Group Wreaks Havoc On Iranian Finances
Predatory Sparrow, a shadowy hacker group believed to be linked to Israeli intelligence agencies or cybersecurity firms, has emerged as a key player in the escalating conflict between Israel and Iran. The group’s name, “Gonjeshke Darande,” translates to “bird’s nest” in Farsi, suggesting that the hackers may be trying to appear as a homegrown Iranian organization.
The origins of Predatory Sparrow are shrouded in mystery, but its most notable attacks have targeted the Iranian gas station payment system, twice disabling thousands of terminals across the country. These disruptions have had a profound impact on the economy, causing widespread disruption to civilians’ ability to access their funds. The hackers’ methods are sophisticated, often using zero-day exploits and advanced malware to breach security systems.
One notable example is the attack on Sepah Bank, Iran’s second-largest bank, in March 2023. The hackers claimed to have destroyed “all” the bank’s data, posting documents that appeared to show agreements between the bank and the Iranian military. These revelations suggest that the bank has been complicit in financing the regime’s ballistic missiles and nuclear program, a major concern for Western powers.
The attack on Sepah Bank was part of a broader campaign by Predatory Sparrow to disrupt Iran’s financial system. In February 2023, the hackers targeted Nobitex, an Iranian cryptocurrency exchange, accusing it of enabling sanctions violations and terrorist financing on behalf of the regime. According to blockchain analysis firm Elliptic, the hackers destroyed over $90 million in Nobitex holdings, a rare instance of hackers burning crypto assets rather than stealing them.
“These cyberattacks are the result of Nobitex being a key regime tool for financing terrorism and violating sanctions,” the hackers posted on their X account. “Associating with regime terror financing and sanction violation infrastructure puts your assets at risk.”
The incident follows another Predatory Sparrow attack on Iran’s finance system, in which the same group targeted Sepah bank, claiming to have destroyed “all” the bank’s data in retaliation for its associations with Iran’s Islamic Revolutionary Guard Corps, and posting documents that appeared to show agreements between the bank and the Iranian military. “Caution: Associating with the regime’s instruments for evading sanctions and financing its ballistic missiles and nuclear program is bad for your long-term financial health,” the hackers wrote.
As the conflict between Israel and Iran continues to escalate, Predatory Sparrow’s cyberattacks have become a major concern for Western powers. The group’s tactics are designed to disrupt the Iranian economy, causing widespread disruption to civilians’ ability to access their funds.
Hamid Kashfi, an Iranian cybersecurity researcher living in Sweden and the founder of the cybersecurity firm DarkCell, says he has heard from contacts in Iran that Sepah’s online banking and ATMs have been offline since the attacks began, causing widespread disruption to civilians’ ability to access their funds. “There has been a lot of collateral damage,” Kashfi says. “It just seems to be straight up causing damage and chaos. I can’t think of what other logic would be behind it.”
The motivations behind Predatory Sparrow’s cyberattacks are complex and multifaceted. While some analysts believe that the group is driven by anti-Iranian sentiment, others argue that its true goal is to disrupt the Iranian economy and undermine the regime’s ability to finance its military program.
In the Nobitex attack, blockchain analysis reveals some of the details of Predatory Sparrow’s sabotage: According to Elliptic, the eight-figure sum stolen from the exchange was moved to a series of crypto addresses that all started with variations on the phrase “FuckIRGCterrorists.” Those so-called “vanity” addresses typically can’t be created in any way that offers control or recovery of funds held there, so Elliptic concludes that moving funds to those addresses was instead a pointed method of destroying the money. “The hackers clearly have political rather than financial motivations,” says Tom Robinson, Elliptic’s cofounder.
As the conflict between Israel and Iran continues to escalate, it is clear that Predatory Sparrow will play a major role in the cyberwarfare campaign. With its sophisticated tactics and devastating consequences, this shadowy hacker group has emerged as a key player in the fight for control of the Iranian financial system.
The global community must take notice of Predatory Sparrow’s activities and consider taking action to disrupt their operations. The consequences of inaction will be severe, with widespread disruption to civilians’ ability to access their funds and a major blow to the Iranian economy.