File · Predatory Sparrow · Unknown · misp-galaxy · refreshed 2026-10-06
Predatory Sparrow
- Indra
- Gonjeshke Darande
sigil · no ATT&CK coverage stated
Analyst brief
misp-galaxyA self-proclaimed hacktivist group that carried out attacks against Iranian railway systems and against Iranian steel plants.
Observed targets (as stated by the sources)
1 countries · 2 sectorsassessed originnot stated by sourcesobserved targets · 1
countries · 1
- Iran
sectors · 2
- Critical manufacturing
- Transportation systems
as stated by MISP galaxy / ransomware.live — not inferred
Detections
9 rules · Sigma · QRadar · CortexIndicator
Known-malicious file hash observedAPT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Indicator
Malicious HashesAPT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more
Generated by skopnix from this finding, each with false-positive notes. Open the list →
Take it with you
keyless · no signupReferences
3 sourcesTrack Predatory Sparrow on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.