Gonjeshke Darande (Predatory Sparrow)

Gonjeshke Darande (Predatory Sparrow)

Gonjeshke Darande (Persian: گنجشک درنده; commonly translated as “Predatory Sparrow”) is the name used by a clandestine cyber actor known for high-impact, politically motivated cyberattacks targeting Iranian critical infrastructure and state-linked institutions. The group presents itself as an indigenous anti-regime “hacktivist” operation, but it is widely assessed by journalists and analysts to be state-backed or state-aligned, with frequent public speculation of Israeli linkage; direct, officially confirmed attribution is generally not available in public sources. (wired.com)

Name and claimed identity

• The group’s primary branding is the Persian name “Gonjeshke Darande,” with “Predatory Sparrow” used in English-language reporting. (time.com)
• In public messaging (notably on social platforms), it has framed its actions as retaliation for policies and activities attributed to the Islamic Republic and its regional proxies, and it has sometimes claimed it takes steps to reduce harm to civilians—a claim that has been debated given the real-world risks of industrial sabotage. (wired.com)

Typical targets and methods

Predatory Sparrow is most associated with disruptive operations (not merely espionage), including:

• Fuel distribution and payment/rationing systems, causing widespread service disruption. (time.com)
• Industrial control environments (e.g., steel production), where interference can create dangerous physical consequences. (wired.com)

The group is notable for pairing operational disruption with public signaling—issuing statements, releasing selected material, and sometimes publishing imagery/videos presented as proof of access and impact. (wired.com)

Notable publicly reported operations (selected)

• October 26, 2021 – Iranian fuel system cyberattack: A cyberattack disrupted Iran’s fuel distribution system and related services; Iranian officials publicly accused external adversaries (including the U.S. and Israel) in connection with the incident, and later reporting connected similar fuel disruptions to Predatory Sparrow. (en.wikipedia.org)
• June 27, 2022 – Iranian steel industry attacks: The group claimed attacks against major Iranian steel producers; reporting described disruptive effects and circulated footage purportedly showing industrial disruption and fire at a facility. (timesofisrael.com)
• December 18, 2023 – Gas station disruptions across Iran: A large share of Iranian gas stations reportedly experienced service outages; major outlets reported that Predatory Sparrow claimed responsibility and said it intentionally left some stations operating and warned emergency services in advance. (time.com)

Attribution and controversy

• Attribution: While the group’s operations are often described in media as Israel-linked or consistent with Israeli strategic interests, public proof meeting a definitive evidentiary standard is typically absent, and governments rarely confirm such connections. (wired.com)
• Ethical and safety concerns: Even when framed as “controlled” disruption, attacks on fuel and industrial systems can affect civilians and pose physical risk, which has made the group a prominent case study in the blurred boundary between cyber operations and kinetic harm. (wired.com)

If you tell me whether you want a short bio (who they likely are) or a timeline-focused summary (what they did, when, and to whom), I can format it accordingly.