Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #4[disputed][awaiting moderator]in section: Malware and Technical Capabilities

   “which accepted an encrypted JSON configuration file with 23 configurable parameters”

   reviewerThe Meteor wiper used in the July 2021 railway attack accepted an encrypted JSON configuration file with 23 configurable parameters.The page's own cited primary source does not support '23' — an independent count of the keys it lists yields 22. This is a specific, checkable technical detail that appears to be a miscount in the original write-up.
   Proposed correction (not yet applied)

   which accepted an encrypted JSON configuration file with 22 configurable parameters
   citedwww.sentinelone.com/labs/meteorexpress-m…with-epic-troll/

No source the reviewer could reach confirms or contradicts the claim.

1. #11[unverifiable][awaiting moderator]in section: International Law and Regulatory Context

   “The 2025 Bank Sepah and Nobitex operations were analyzed under Scenario 12 (cyber operations against computer data) and Scenario 18 (legal status of cyber operators during armed conflict), as the attacks occurred during an active military exchange between Israel and Iran in June 2025.”

   reviewerThe CCDCOE analyzed the 2025 Bank Sepah and Nobitex operations under 'Scenario 12' (cyber operations against computer data) and 'Scenario 18' (legal status of cyber operators during armed conflict).Could not independently confirm or contradict; the CCDCOE site was unreachable (503) throughout the review and this tool could not fetch the archived snapshot either. Flagged as unverifiable rather than link_rot since the outage may be transient.
   citedcyberlaw.ccdcoe.org/wiki/Predatory_Sparr…structure_(2025)

A cited source no longer resolves or no longer says what the page attributes to it.

1. #5[link rot][awaiting moderator]in the cited sources

   “https://web.archive.org/web/20260726112248/https://www.timesofisrael.com/fire-causes-millions-in-damage-to-chabad-center-in-ukrainian-town-where-founder-buried/”

   reviewerSource citation for the Times of Israel steel-plants article archives the correct page.The source's primary url field is fine and live; only the archive_url is a mismatched/dead snapshot pointing to unrelated content. Replacement snapshot located and verified to cover the correct article.
   Proposed correction (not yet applied)

   http://web.archive.org/web/20260726112229/https://www.timesofisrael.com/large-cyberattack-on-iranian-industrial-sector-targets-three-steel-plants/
   citedwww.timesofisrael.com/large-cyberattack-…ee-steel-plants/

The cited evidence supports part of the claim but not all of it.

1. #12[partially supported][awaiting moderator]in section: Cryptocurrency and Financial Infrastructure Attacks (2025)

   “Nobitex's CEO denied any IRGC affiliation.”

   reviewerNobitex's CEO denied any IRGC affiliation.A corporate/founder-level denial is well documented, but no source found attributes the specific denial to the CEO by title as the page states; this may be a slight overspecification of who issued the denial.
   citedwww.elliptic.co/blog/iranian-crypto-exch…pro-israel-group

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “the June 2025 destruction of approximately $90 million in digital assets stolen from Iran's largest crypto exchange, Nobitex”

   reviewerIn June 2025, Predatory Sparrow destroyed approximately $90 million in digital assets stolen from Nobitex, Iran's largest crypto exchange.Widely corroborated by Elliptic, Halborn, Hudson Institute, and multiple news outlets, though a few secondary sources (Decrypt) report a slightly lower figure (~$85M).
   citedwww.elliptic.co/blog/iranian-crypto-exch…pro-israel-group
2. #2[confirmed][no action needed]in section: Cryptocurrency and Financial Infrastructure Attacks (2025)

   “the attackers transferred the assets to vanity wallet addresses whose public keys contained variations of the phrase 'F*ckIRGCterrorists.' Because the private keys for such vanity addresses cannot be computationally derived, the funds were permanently inaccessible — effectively burned.”

   reviewerPredatory Sparrow transferred stolen Nobitex funds to vanity wallet addresses containing variations of 'F*ckIRGCterrorists', rendering the funds permanently inaccessible.Directly confirmed by the cited Elliptic source, independently fetched.
   citedwww.elliptic.co/blog/iranian-crypto-exch…pro-israel-group
3. #3[confirmed][no action needed]in section: Cryptocurrency and Financial Infrastructure Attacks (2025)

   “Elliptic estimated approximately $366 million in sanctions-linked activity had passed through Nobitex; Chainalysis estimated approximately $68 million, and Crystal Intelligence approximately $22 million in direct transfers from sanctioned wallets.”

   reviewerElliptic estimated ~$366 million, Chainalysis ~$68 million, and Crystal Intelligence ~$22 million in sanctions-linked/direct transfers through Nobitex.Figures match independent reporting exactly; not directly from the page's own cited Elliptic/Halborn links but corroborated by a separate Reuters investigation.
   citedwww.elliptic.co/blog/iranian-crypto-exch…pro-israel-group
4. #6[confirmed][no action needed]in section: Operational History: Infrastructure Attacks (2021–2023)

   “On July 9–10, 2021, the group disrupted Iran's national railway system, causing widespread train delays and displaying messages on station boards directing passengers to call the office of Supreme Leader Ayatollah Ali Khamenei.”

   reviewerOn July 9-10, 2021, Predatory Sparrow disrupted Iran's national railway system, displaying messages directing passengers to call Khamenei's office.Confirmed by contemporaneous reporting; date and detail match.
   citedwww.sentinelone.com/labs/meteorexpress-m…with-epic-troll/
5. #7[confirmed][no action needed]in section: Operational History: Infrastructure Attacks (2021–2023)

   “In October 2021, the group conducted a major cyberattack on Iran's national fuel payment system, disabling approximately 4,300 gas stations — roughly 80% of the country's total — by attacking the intranet-based system used to process government-subsidized fuel purchases using smart cards.”

   reviewerIn October 2021, Predatory Sparrow disabled approximately 4,300 Iranian gas stations (~80% of the national total) and hijacked digital billboards to display 'Khamenei, where is our fuel?'Confirmed; the section text says only 'October 2021' while the timeline entry correctly gives the specific date of October 26, 2021 — consistent, not contradictory.
   citeden.wikipedia.org/wiki/2021_Iranian_fuel_cyberattack
6. #8[confirmed][no action needed]in section: Operational History: Infrastructure Attacks (2021–2023)

   “On June 27, 2022, the group executed coordinated cyberattacks against three Iranian steel companies — Khuzestan Steel, Mobarakeh Steel, and Hormozgan Steel — all alleged to be affiliated with the IRGC or the Basij.”

   reviewerOn June 27, 2022, Predatory Sparrow attacked three Iranian steel companies — Khuzestan Steel, Mobarakeh Steel, and Hormozgan Steel — alleged to be affiliated with the IRGC or Basij.Full claim is supported by at least one of the section's cited sources (ThreatDown), even though another cited source (CyberScoop) only partially corroborates it. Independent search confirms the same detail.
   citedwww.threatdown.com/blog/predatory-sparro…ng-workers-safe/
7. #9[confirmed][no action needed]in section: Operational History: Infrastructure Attacks (2021–2023)

   “On December 18, 2023, the group struck Iran's fuel distribution network again, disrupting approximately 70% of the country's gas stations, prompting Iranian Oil Minister Javad Owji to confirm the attack.”

   reviewerOn December 18, 2023, Predatory Sparrow disrupted approximately 70% of Iranian gas stations; Oil Minister Javad Owji confirmed the attack.Confirmed by independent reporting beyond the page's own cited CNBC source.
   citedwww.cnbc.com/2023/12/18/pro-israel-hacke…as-stations.html
8. #10[confirmed][no action needed]in section: Background and Identity

   “Security researcher Juan Andres Guerrero-Saade of SentinelLabs described the group's operations as distinguished by 'restraint' that signals 'greater capabilities' — a hallmark more consistent with state-directed operations than independent hacktivism.”

   reviewerSentinelLabs researcher Juan Andres Guerrero-Saade described the group's operations as distinguished by 'restraint' that signals 'greater capabilities.'Minor rephrasing of the original quote's word order but the substance and attribution are accurate.
   citedcyberscoop.com/predatory-sparrow-israel-gaza-cyber/
9. #13[confirmed][no action needed]in section: Cryptocurrency and Financial Infrastructure Attacks (2025)

   “On June 17, 2025, the group claimed to have attacked Bank Sepah, a major Iranian state-owned bank with alleged IRGC ties.”

   reviewerOn June 17, 2025, Predatory Sparrow claimed to have attacked Bank Sepah, deploying wiper malware and disrupting ATM, internet, and mobile banking.Date and core facts confirmed; the 'wiper malware' and 'mobile banking' specifics come from other cited sources, not from TechCrunch alone, but are not contradicted.
   citedtechcrunch.com/2025/06/17/pro-israel-hac…anian-bank-hack/
10. #14[confirmed][no action needed]in section: Cryptocurrency and Financial Infrastructure Attacks (2025)

    “Blockchain analytics firm Elliptic confirmed the breach, noting on-chain evidence that Nobitex wallets had transacted with entities associated with Hamas, Palestinian Islamic Jihad, Houthi organizations, and IRGC-linked ransomware actors.”

    reviewerElliptic confirmed the Nobitex breach and found on-chain evidence of Nobitex wallets transacting with entities associated with Hamas, Palestinian Islamic Jihad, Houthi organizations, and IRGC-linked ransomware actors.Directly and fully confirmed by independently fetching the cited primary source.
    citedwww.elliptic.co/blog/iranian-crypto-exch…pro-israel-group