Hacktivists claiming attack on Iranian steel facilities dump tranche of 'top secret documents'

Incident just the latest iteration of the back and forth between Israeli and Iranianian-aligned hackers.

The group claiming responsibility for cyberattacks on multiple Iranian steel facilities last month posted on Thursday what it called a cache of nearly 20 gigabytes of data containing corporate documents that reveal the facilities’ affiliation with Iran’s powerful Islamic Revolutionary Guard Corps.

In a series of tweets in both English and Persian, the group — which calls itself Gonjeshke Darande or Predatory Sparrow — said the 19.76 gigabyte cache was just the “first part” of what would be released. The group also posted an image of what appears to be the inside of a steel facility.

CyberScoop has not independently verified the contents of the document release.

When the group initially claimed the June 27 attack, it posted a video that appeared to show damage to equipment at the state-owned Khouzestan Steel Company, one of Iran’s primary steel production facilities. Initial reports suggested the attack disrupted operations at the plant, but the company and the Iranian government denied that it had any major effect.

In the video the group included a message that explained that the companies “are subject to international sanctions and continue their operations despite the restrictions.” The attacks, the group added, were “being carried out carefully so to protect innocent individuals” and are “in response to the aggression of the Islamic Republic.”

Gonjeshke Darande is just one of several names, including Indra, the group uses. The shadowy outfit claims to be independent, but some speculation has suggested it could be the work of the Israeli government, given the of access needed to carry out the attacks, the sophisticated nature of the operation and the messaging during and after the apparent hacks.

Israeli Defense Minister Benny Gantz ordered an investigation into recent media leaks that “hinted” that an Israeli military intelligence unit was responsible for the attack on the steel facilities, the Times of Israel reported.

The Israeli Ministry of Defense did not immediately respond to a request for comment.

The group has claimed other digital assaults on key Iranian targets, such as the October 2021 attack that hobbled Iranian state-controlled gasoline distribution and one on August 2021 that hit the Iranian railway system.

In both cases, the group displayed messages — either on the gas pumps or on the displays for train schedules — with the office number of Iran’s supreme leader, Ayatollah Ali Khamenei, which some threat intelligence experts interpreted as trolling.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems