apt

Predatory Sparrow

active · last signal 1y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Gonjeshke DarandeIndra (suspected overlap)

Attribution

Hacktivist-branded group widely assessed to align with Israeli interests; likely state or state-linked, attribution unconfirmed

Origin

Unknown (Israel-aligned, assessed)

First seen

2021

Last active

2025

Motivation

Sabotage / Information operations

Attribution confidence

medium

MENA targeting

Iran

Sectors

Rail transport, steel manufacturing, fuel distribution, banking

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Iran (Rail transport, steel manufacturing, fuel distribution sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
Inside a New Cyber Weapon: IOCONTROLreportORKL2024-12-18
Israel-Hamas War in Cyber February 2024 Tool of First ResortreportORKL2024-02-08
2023 State of The Threat – A Year in ReviewreportORKL2023-09-29

Uses

Financial ThefttechniqueATT&CK mapping
Data Manipulation: Stored Data ManipulationtechniqueATT&CK mapping
Data DestructiontechniqueATT&CK mapping
Disk Wipetechnique

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Predatory Sparrow's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

2 / 4

Mean robustness (of covered)

Useful?