Hacktivist group claims to take out gas stations across Iran

A hacktivist group called "Predatory Sparrow" ("Gonjeshke Darande" in Persian) claimed that it had disabled the majority of gas stations across Iran in a cyberattack on Monday.

"We, Gonjeshke Darande, carried out another cyberattack today, taking out a majority of the gas pumps throughout Iran. This cyberattack comes in response to the aggression of the Islamic Republic and its proxies in the region. [Iranian Supreme Leader Ali] Khamenei, playing with fire has a price," wrote the group in a statement.

"A month ago, we warned you that we’re back and that we will impose cost (sic.) for your provocations. This is just a taste of what we have in store," added the group, attaching screenshots of documents they claimed to have acquired from the servers of the affected gas stations.

Iranians report disruptions at gas stations

Shortly after the statement was issued by Predatory Sparrow, Iranian state-run media reported that the majority of gas stations across the country had stopped operating due to a suspected cyber attack.

Jalil Salari, a deputy petroleum minister in Iran, told the Iranian Fars News Agency that about 60% of the gas stations across the country were experiencing issues. Salari claimed that the issue would be fixed by the end of the day.

Reza Navaz, the spokesperson for the National Petrol Station Owners Association, had earlier told the Fars News Agency that there was a "software problem" at some gas stations, but had also insisted that "there is no problem in supplying fuel to the cars at the stations and there is enough gasoline available."

Navaz added that "experts are fixing the problem" and asked that drivers who have enough gas not go to gas stations for now until the issue is resolved. Fars News Agency noted that a cyberattack was one of the possible causes of the disruption.

Who is Predatory Sparrow?

The Predatory Sparrow hacktivist group has previously claimed responsibility for cyberattacks targeting gas stations, the railway system, and steel plants in Iran. The hacktivist group has been linked to Israel by some reports. A past attack on Iranian gas stations claimed by the group was attributed to Israel by two unnamed US defense officials, according to The New York Times.

In October, John Hultquist, chief analyst for Mandiant Intelligence at Google Cloud, told reporters that the Predatory Sparrow was "certainly a player to watch" after Predatory Sparrow announced that it was returning to operations after a hiatus since January.

Juan Andrés Guerrero-Saade, the senior director of SentinelLabs, told the CyberScoop website in October that "What makes Predatory Sparrow so brilliant is that each activity signals greater capabilities by virtue of their restraint. We could’ve, but we didn’t, so don’t make us, cause we can.' ‘Hacktivist’ fronts temporarily taking down websites for headlines look like school children in comparison."