{"actor":{"id":"predatory-sparrow","name":"Predatory Sparrow","aliases":["Gonjeshke Darande"],"vendor_names":{},"mitre_gid":null,"type":"hacktivist","type_verbatim":"Hacktivist collective (suspected state-sponsored)","secondary_types":[],"origin":"IL","origins":["IL"],"targets":[],"target_regions":[],"sectors":[],"threat_types":["dis"],"mitre_techniques":[],"gir_codes":[],"active_since":2021,"brief":"Predatory Sparrow (also known as Gonjeshke Darande) is a hacktivist collective widely suspected of operating as a state-sponsored front, conducting high-profile destructive cyberattacks against Iranian critical infrastructure. The group's operations are characterized by sabotage and disruption, targeting sectors such as steel manufacturing, fuel distribution, and railway systems, causing significant real-world physical and economic damage. Their stated motivation is ideological opposition to the Iranian government, though the sophistication and precision of their attacks strongly suggest backing from a nation-state actor, widely assessed to be Israel.","attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:25.832023+00:00","updated_at":"2026-05-20T15:09:29.839+00:00","url":"https://aptatlas.net/actors/predatory-sparrow"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/predatory-sparrow/stix","navigator":"https://aptatlas.net/api/v1/actors/predatory-sparrow/navigator"}}