Israel-linked hacking group claims attack on Iranian gas pumps

The incident comes as Iranian-backed Houthi fighters step up attacks on commercial shipping vessels in the Red Sea.

A sophisticated hacking group linked to Israel claimed responsibility on Sunday for carrying out a cyberattack that disrupted a significant portion of Iran’s gas stations. 

The group known as Predatory Sparrow wrote in a statement to X, the social media platform formerly known as Twitter, that the attack had knocked out “a majority of the gas pumps throughout Iran” and that it came “in response to the aggression of the Islamic Republic and its proxies in the region.”

“Khamenei, playing with fire has a price,” the post added, referring to Iran’s supreme leader. 

Iran’s oil minister, Javad Owji, told Iranian state TV that as many as 70% of the country’s gas stations had been disrupted in the incident, which is the second time in the past two years that Predatory Sparrow has disrupted gasoline supplies in Iran. An Israeli government spokesperson declined to comment on the incident during a Monday briefing. 

Following Hamas’s Oct. 7 attack on Israel, a flurry of hacktivist groups on both sides of the conflict have attempted to take down and deface websites, but operations linked to the conflict have been mostly opportunistic and exaggerated in impact. Sunday’s incident in Iran appears to be the first cyberattack since the current round of fighting began to have major physical consequences. 

The attack comes against the backdrop of growing tensions in the Middle East as fighting continues between Israel and Hamas. Iranian-backed Houthi fighters have in recent weeks carried out a string of attacks targeting commercial shipping vessels in the Red Sea, prompting some major oil producers to halt oil shipments via the Suez Canal. 

In an online message to CyberScoop on Tuesday, a representative of the group said that “we attacked Iran because of their aggression in the region by using proxies like the Houthis, Hezbollah and more.” 

U.S. destroyers deployed to the Red Sea have shot down a string of Houthi drones in recent weeks following drone attacks on commercial shipping vessels. Some vessels transiting the region have taken to broadcasting that they are traveling with armed guards aboard in an attempt to deter attacks, and U.S. officials are expected to announce the formation this week of a naval task force to protect ships in the region. 

Houthi fighters have pledged to carry out attacks on what they have described as commercial vessels linked to Israel as part of a retaliatory campaign carried out in solidarity with Hamas. 

Predatory Sparrow has not declared its affiliation with Israel, but the group is widely believed to be a persona created by Israeli security services as part of its long-running conflict with Iran. The group was linked to an attack in October 2021 that also disrupted the supply of automotive fuel. Last year, the group struck steel manufacturing plants in Iran. 

Anonymous U.S. defense officials have been quoted saying that they believe the 2021 attack by Predatory Sparrow was the work of Israel. 

“This group has been one half of a cyber conflict that was going on within Iran and Israel before the most recent violence erupted,” said John Hultquist, the chief analyst at Mandiant Intelligence. 

Predatory Sparrow is notable for the way it calibrates its attacks. In a statement to X, Predatory Sparrow said “this cyberattack was conducted in a controlled manner while taking measures to limit potential damage to emergency services.” The group said it had “delivered warnings to emergency services across the country before the operation began, and ensured a portion of the gas stations across the country were left unharmed for the same reason, despite our access and capability to completely disrupt their operation.” 

Efforts to limit the impact of attacks in this manner — requiring a measure of technical sophistication and in all likelihood a legal team vetting operations — is a major reason why experts believe the group to be the work of Israeli security services. 

AJ Vicens contributed reporting to this article.

Updated Dec. 19, 2023: This article has been updated with comment from a representative of Predatory Sparrow.

Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn

Iranian government hackers are launching disruptive cyberattacks on American energy and water infrastructure, U.S. government agencies “urgently” warned Tuesday. The hackers are taking aim at devices and…

Stryker attack highlights nebulous nature of Iranian cyber activity amid joint U.S.-Israel conflict

Researchers say Israeli government likely behind AI-generated disinfo campaign in Iran

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems