Iran’s Bank Sepah disrupted by cyberattack claimed by pro

The attack introduces a clear cyber element with immediate consequences for the country’s critical infrastructure amid a growing conflict between Israel and Iran.

Bank Sepah’s website is offline following a hacktivist group’s claimed attack on the Iran state-owned bank. The group, known as Predatory Sparrow —  or Gonjeshke Darande in Persian — said in a social media post early Tuesday that it “destroyed the data of the Islamic Revolutionary Guard Corps’ Bank Sepah.”

Iran-focused media outlets report Bank Sepah branches are closed, customers are unable to access accounts and payment processing is down. London-based Iran International said Iran’s Fars News Agency confirmed Bank Sepah’s infrastructure was impacted by a cyberattack, resulting in service disruptions.

The attack on one of Iran’s largest financial institutions highlights the growing role of cyber warfare in the escalating conflict between Israel and Iran, and has had immediate consequences for the country’s critical infrastructure. 

Israel on Thursday initiated a massive aerial bombing campaign, targeting Iran’s military systems and leadership, with devastating impact. The countries have been engaged in an ongoing  military conflict, which so far has been limited to airstrikes.

“Any cyber response to this whole episode is probably going to take time. There’s likely to be significant cyber activity, but it may take some time for these operations to spin up,” John Hultquist, chief analyst at Google Threat Intelligence Group, told CyberScoop.

This is why some threat groups such as the China state-sponsored Volt Typhoon and others do long-term probing on networks, prepositioning themselves to strike critical infrastructure at a time of military conflict or other geopolitical opportunity, Hultquist added. 

Predatory Sparrow said it targeted the bank because it “circumvented international sanctions and used the people of Iran’s money to finance the regime’s terrorist proxies, its ballistic missile program and its military nuclear program.”

The hacktivist group previously claimed attacks on steel mills in Iran, the country’s rail system network and gas station payment systems. Predatory Sparrow’s country of origin isn’t clear, but the group has consistently acted against the Iranian regime and in support of Israel’s objectives in Iran.

“They have carried out serious attacks that reflect real skill and sophistication,” Hultquist said.

Iran’s military merged multiple state-owned banks into Bank Sepah in 2020. Bank Sepah International, a London-based subsidiary of Bank Sepah, did not immediately respond to a request for comment. The Central Bank of the Islamic Republic of Iran’s website is also currently offline. 

Stryker attack highlights nebulous nature of Iranian cyber activity amid joint U.S.-Israel conflict

It’s been difficult early on to separate signal from noise, even if the attack on the medical device maker looks like a qualified success for the attackers.

Officials offer $10M reward for information on IRGC-linked leader and close associate

Researchers say Israeli government likely behind AI-generated disinfo campaign in Iran

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems