{"type":"bundle","id":"bundle--37172d15-2c92-5d6e-8770-d40451e396ee","objects":[{"type":"intrusion-set","id":"intrusion-set--13e65bba-6aae-5c86-857b-969ed6ae6226","spec_version":"2.1","created":"2026-05-20T09:52:25.832023+00:00","modified":"2026-05-20T15:09:29.839+00:00","name":"Predatory Sparrow","description":"Predatory Sparrow (also known as Gonjeshke Darande) is a hacktivist collective widely suspected of operating as a state-sponsored front, conducting high-profile destructive cyberattacks against Iranian critical infrastructure. The group's operations are characterized by sabotage and disruption, targeting sectors such as steel manufacturing, fuel distribution, and railway systems, causing significant real-world physical and economic damage. Their stated motivation is ideological opposition to the Iranian government, though the sophistication and precision of their attacks strongly suggest backing from a nation-state actor, widely assessed to be Israel.","aliases":["Gonjeshke Darande"],"first_seen":"2021-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/predatory-sparrow"}],"labels":["hacktivist","dis"]}]}