Predatory Sparrow
Also known asGonjeshke Darande · Indra · COASTLIGHT
Summary
Destructive group operating hacktivist personas that present as opposition to the Iranian regime: Indra and Gonjeshke Darande ("Predatory Sparrow"). Sophos CTU tracks both personas as one group, COASTLIGHT, active since at least June 2019. Check Point tied the July 2021 attacks on Iranian Railways and the Ministry of Roads and Urban Development to Indra, which had earlier hit private companies in Syria (2019–2020), and found three versions of its wiper: Meteor, Stardust and Comet (T1485). The wiper ran from a scheduled task (T1053.005) and displayed the attackers' message on station boards (T1491.001). In June 2022 the group claimed attacks on three Iranian steel companies; Check Point's initial analysis linked the malware, which it named Chaplin, to the attack on Iranian Railways (recorded as assessed). In June 2025 Predatory Sparrow claimed hacks of the state-owned Bank Sepah and the crypto exchange Nobitex; Elliptic traced more than $90 million from Nobitex wallets to vanity addresses that burned the funds, though it had no confirmation that Predatory Sparrow moved them. Sophos notes ICS/OT capability. The attribution is open: Check Point found a nation-state operator unlikely, Sophos calls it possibly state-sponsored, and Elliptic describes it as Israel-linked. last_seen is the last confirmed operation (2021); the 2025 operations are recorded as claimed.
Attribution
Check Point: unlikely state-run; Sophos: possibly state-sponsored; Elliptic: Israel-linked
Tracked by researchers; no state or organisation has been publicly attributed.
- Check Point Research (Research, 2021-08-14)
Unlikely to be operated by a nation-state - Sophos CTU (Research, 2026-10)
Experienced and possibly state-sponsored - Elliptic (Research, 2025-06-18)
A pro-Israel, Israel-linked hacker group
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Bank Sepah and Nobitex hacks — over $90M burned to vanity addressesCLAIMED | 2025-06 | Iran | Financial Services, Cryptocurrency | Elliptic (2025-06-18) — the hacks are confirmed; Predatory Sparrow's responsibility rests on its own claim ("no confirmation yet that the funds were moved by Predatory Sparrow") |
| Iranian steel companies — Chaplin, a Meteor-family wiper (Gonjeshke Darande)ASSESSED | 2022-06 | Iran | Manufacturing | Check Point Research, via Risky Business News (2022-06-28) — "initial analysis" links the malware to the 2021 Iranian Railways attack; CyberScoop (2022-06-27) — group claim, Iranian state media reported an attack |
| Iranian Railways and Ministry of Roads wiper attacks (Meteor) | 2021-07 | Iran | Transportation, Government | Check Point Research (2021-08-14) — tied to the Indra persona |
| Wiper attacks on private companies in Syria (Indra) | 2019 – 2020 | Syria | Undisclosed | Check Point Research (2021-08-14) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 3
| Execution1 | T1053.005Scheduled Task |
|---|---|
| Impact2 | T1485Data DestructionT1491.001Internal Defacement |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| Meteor | Wiper | Windows |
| Stardust | Wiper | Windows |
| Comet | Wiper | Windows |
| Chaplin | Wiper (Meteor family) | Windows |
Infrastructure patterns
- Wiper staged from the victim's own domain share (SYSVOL) and run once from a scheduled task (Check Point, 2021)
- Stolen crypto sent to vanity addresses with no usable private keys, burning the funds (Elliptic, 2025)
Reporting and advisories 5
- Check Point Research
Indra — hackers behind recent attacks on Iran (Aug 2021) - Elliptic
Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel group (Jun 2025) - Sophos CTU
COASTLIGHT threat profile - Risky Business News, relaying Check Point Research
Hackers hit Iranian steel industry — Chaplin malware (Jun 2022) - CyberScoop
Iranian steel facilities suffer apparent cyberattacks (Jun 2022)