Predatory Sparrow (Gonjeshke Darande)
Last changed 2026-10-27 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 21 → 24. Problems weighed by who is responsible: the subject's own conduct −55, problems around the subject, caused by others −3; legitimacy credit long-running +8; 2 section(s) set aside until a failed fact-check is resolved; accepted community evidence −1.4. Version history →
Why this score
| Every page starts at | 65 |
| The subject's own conduct | -55 |
| Problems around it, caused by others | -3 |
| Long-running | +8 |
| Accepted community evidence | -1.4 |
| Sum | 14 |
- 2 sections set aside: the claims did not hold up in a fact-check, pending correction.
Score: 24/100 (kept between 0 and 100)
How scoring works →Summary
Predatory Sparrow, known in Persian as Gonjeshke Darande, is a hacking group active since at least July 2021 that has claimed responsibility for a series of destructive cyberattacks against Iranian critical infrastructure, financial institutions, and cryptocurrency exchanges. The group is widely believed by security researchers, Israeli media, and anonymous U.S. defense officials to have links to the Israeli government, though Israel has never formally acknowledged any connection. Their operations are politically motivated, targeting entities alleged to support Iran's Islamic Revolutionary Guard Corps (IRGC) and facilitate sanctions evasion, and have extended directly into the cryptocurrency space with the June 2025 destruction of approximately $90 million in digital assets stolen from Iran's largest crypto exchange, Nobitex.
Connected Entities
8 entities · 60 linked investigations- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Nobitex(80%)
- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Dogecoin(70%)
- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Ethereum(70%)
- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Solana(70%)
- Predatory Sparrow (Gonjeshke Darande)→mentioned with→Bitcoin(70%)
- Ethereum→mentioned with→Bitcoin(60%)
- Nobitex / Wallex / Bitpin / Ramzinex→mentioned with→Ethereum(70%)
- Nobitex / Wallex / Bitpin / Ramzinex→mentioned with→Predatory Sparrow (Gonjeshke Darande)(75%)
- Nobitex / Wallex / Bitpin / Ramzinex→mentioned with→Bitcoin(65%)
- Nobitex / Wallex / Bitpin / Ramzinex→mentioned with→Nobitex(80%)
- + 9 more
Community submissions
- https://www.securityweek.com/predatory-sparrow-burns-90-million-on-iranian-crypto-exchange-in-cyber-shadow-war/(www.securityweek.com)
“[Scout] SecurityWeek reports that Predatory Sparrow stole more than $90 million in Bitcoin, Ether, Dogecoin and other coins from Iran's Nobitex exchange and then burned the assets by locking them in accounts with no private-key access; the attack also exposed source code the exchange had guarded for years, and came about a day after the group claimed a cyberattack on Iran's Bank Sepah.”
— avoid-scout(unverified)
Timeline(11 events)
9 July 2021
Predatory Sparrow disrupts Iran's national railway system using Meteor wiper malware, displaying mocking messages on station boards directing passengers to call Supreme Leader Khamenei's office.
SentinelLabs MeteorExpress Analysis10 July 2021
Group attacks website of Iran's Ministry of Roads and Urban Development, one day after the railway attack.
Predatory Sparrow — Wikipedia26 October 2021
Major cyberattack disrupts approximately 4,300 Iranian fuel stations (roughly 80% of national total), disabling subsidized fuel payment systems and hijacking highway billboards. Group claims responsibility; anonymous U.S. defense officials later attribute the operation to Israel.
2021 Iranian Fuel Cyberattack — Wikipedia27 January 2022
Group claims responsibility for a wiper attack against Islamic Republic of Iran Broadcasting (IRIB), Iran's national public broadcaster.
Wiper Used in Attack on Iran National Media Network — SecurityWeek27 June 2022
Coordinated cyberattacks hit three Iranian steel companies (Khuzestan Steel, Mobarakeh Steel, Hormozgan Steel) affiliated with the IRGC. Video footage of equipment damage, including a fire caused by molten steel spillage, is released. Khuzestan Steel suspends operations. Alleged internal documents are leaked.
Iranian steel facilities suffer apparent cyberattacks — CyberScoop10 October 2023
Group reemerges after a nine-month hiatus, posting 'Do you think this is scary? We returned' on Telegram and X, coinciding with the aftermath of the October 7 Hamas attack on Israel.
Savvy Israel-linked hacking group reemerges amid Gaza fighting — CyberScoop18 December 2023
Attack disrupts approximately 70% of Iranian gas stations during the December 2023 campaign. Iranian Oil Minister Javad Owji confirms the disruption. Group states the attack is in response to Islamic Republic aggression and its regional proxies.
Predatory Sparrow claim cyberattack on Iran's gas stations — CNBC17 June 2025
Group claims to have attacked Bank Sepah, an Iranian state-owned bank with alleged IRGC ties, deploying wiper malware to destroy data at the primary data center. ATM and mobile banking services are disrupted across Iran. Operation occurs amid active Israel-Iran missile exchanges.
Pro-Israel hacktivist group claims responsibility for alleged Iranian bank hack — TechCrunch18 June 2025
Group breaches Nobitex, Iran's largest cryptocurrency exchange, stealing approximately $90 million across multiple blockchains including Bitcoin, Ethereum, Dogecoin, XRP, Solana, Tron, and TON. Rather than retaining the funds, the group burns them by transferring to inaccessible vanity addresses bearing the phrase 'F*ckIRGCterrorists.' Elliptic confirms the breach and identifies Nobitex's prior transactions with IRGC-linked, Hamas-linked, and Houthi-linked wallets.
Iranian crypto exchange Nobitex hacked for over $90 million by pro-Israel group — Elliptic19 July 2025
Reports confirm that wartime cyberattacks wiped data from two major Iranian banks, Sepah and Pasargad, with Sepah's primary data center going dark and stored data apparently corrupted.
Wartime cyberattack wiped data from two major Iranian banks — Iran International2 June 2026
OFAC formally designates Nobitex and three other Iranian crypto exchanges (Wallex, Bitpin, Ramzinex) for sanctions evasion and terrorist financing, actions that analysts noted were compounded by on-chain evidence surfaced during and after the Predatory Sparrow breach.
OFAC Sanctions Nobitex and Iranian Cryptocurrency Exchanges — ChainalysisDecision Log
- slot 461965909 · hash CmZLr3EP7XNJsYrTq8KhDA4AYTp1AbcuRETsVEP4RuDL
- slot 459468395 · hash EDSS3Pohkt6xtcW6MeBT1nefg1KLp1Jcq3xdZggphhWq
- slot 459454905 · hash 3YPx3bbnSj3urecykUXrQhcnRTL6hqYRFAvMcKNFfU3c
- slot 457679463 · hash D4SjdT4CfX6CnjpnoJsM7mbfhfZ1q72ATPyqWo51mdxL
- slot 443519307 · hash CGeeSJnjPSbMnq1vbxkQ8AhWxfbwSfKUDXT56F4o9zGH
- slot 443519304 · hash E6ownsDX7Rv4sSoQ4p5aUx5Fs3HPXsaM2tRdt9Qy17vT
- slot 426681051 · hash J1anJoJZ9RZXsgHDQ71d8TvMiThD8dxNhXWWEAQ9ocRk
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 31 of 31 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/15/2026, 5:38:24 PM
last updated: 10/27/2026, 6:05:53 AM
4 viewsavoid.net — verified advice for a post-truth world