The conflict between Israel and Iran is spilling over into the digital world, inflaming a decades-long campaign of hacks and espionage between two nations renowned for their cyber prowess.
On Tuesday, a pro-Israel hacking group claimed responsibility for a disruptive cyberattack against a major Iranian bank, and Iran’s state-run IRIB News reported that Israel had launched a full-scale cyberattack on the country’s critical infrastructure.
Iran’s Fars News Agency, affiliated with the Islamic Revolutionary Guard Corps, reported that the country has endured more than 6,700 distributed denial-of-service attacks over the past three days. It said temporary internet restrictions were implemented as a measure to blunt the impact of large-scale cyberattacks. DDoS attacks overwhelm servers with artificial traffic, disrupting access to websites and online services.
Iranians were reporting widespread issues accessing the internet on Tuesday night, with many virtual private networks, or VPNs, rendered unusable. Customers also reported problems with banking services, including banking machines and online systems. It’s not clear if the problems were the result of cyberattacks or efforts by the government to minimize their impact.
The attacks tied to Israel herald a new front in the escalating Middle East conflict — but the countries’ cyber rivalry spans two decades.
Iran and its regional proxies, such as Hamas, have attempted a wide variety of cyberattacks against Israel in recent years — including information operations, data destruction attacks and phishing campaigns — with mixed results, according to Google.
Israel is widely considered one of the world’s most advanced and capable countries in launching cyberattacks. An operation called Stuxnet, uncovered in 2010 and tied to the US and Israel, sabotaged hardware believed to be responsible for Iran’s nuclear weapons development. One of the most advanced and impactful hacking operations in history, Stuxnet demonstrates the longstanding centrality of cyber to the Israel-Iran conflict.
The claims of Predatory Sparrow, which took credit for hacking Iran’s Bank Sepah, are the latest manifestation of that digital tit-for-tat.
The group is known for launching significant cyberattacks against Iran over the last five years while maintaining the image of a “hacktivist” organization. Many cybersecurity experts within private industry have suggested Private Sparrow is linked to the Israeli government.
Israel’s Ministry for Foreign Affairs didn’t respond to a request for comment. Predatory Sparrow couldn’t be reached for comment.
“Most disruptive and destructive cyberattacks are about influence and psychological impact rather than practical impact,” said John Hultquist, chief analyst at Google’s Threat Intelligence Group. “That’s why a lot of them involve an effort to publicize the incidents which oftentimes includes a fictitious hacktivist front.”
Predatory Sparrow posted on both Telegram and X at 4 a.m. Tuesday New York time that it had successfully “destroyed the data” of Bank Sepah, claiming that the institution was used to circumvent international sanctions.
Bank Sepah couldn’t be reached for comment.
Predatory Sparrow has been active since 2021. The group appeared in public when they took credit for destroying data in Iran’s national railway system resulting in delays around the country. Iran’s Ministry of Roads and Urban Development were hit by hackers around the same time with the same tool designed to destroy computer files.
In other attacks, Predatory Sparrow was blamed for targeting point-of-sale systems at Iranian gas stations, causing a malfunction at Iran’s Khouzestan steel mill that caused molten steel to spill onto the steel plant’s floor and publicizing the alleged phone number of Iranian Supreme Leader Ali Khamenei.
The attackers are unique in that there is relatively little technical information about the hacks compared to similar campaigns, according to security experts. The kind of destructive efforts for which Predatory Sparrow is known tend to destroy the technical forensic evidence that analysts need to understand it.
Often, the group has used social media to promote its activity, a tactic that experts say is proof that Predatory Sparrow aims to have a psychological impact. The hack against Bank Sepah came with its own publicity push, with Predatory Sparrow warning that “this is what happens to institutions dedicated to maintaining the dictator’s terrorist fantasies.”
This article was generated from an automated news agency feed without modifications to text.
