Latest news with #PredatorySparrow
Mint
14 hours ago
- Business
- Mint
How Israel-aligned hackers hobbled Iran's financial system
While Israel and the U.S. were bombing Iran's nuclear sites, another battlefield emerged behind the scenes: the financial infrastructure that keeps Tehran connected to the world. Israeli authorities, and a pro-Israeli hacking group called Predatory Sparrow, targeted financial organizations that Iranians use to move money and sidestep the U.S.-led economic blockade, according to Israeli officials and other people familiar with the efforts. U.S. sanctions, imposed off-and-on for decades due to Tehran's nuclear program and support for Islamist groups, have aimed to cut Iran off from the international financial system. Predatory Sparrow, which operates anonymously and posts updates of its activities on X, said this past week that it crippled Iran's state-owned Bank Sepah, which services Iran's armed forces and helps them pay suppliers abroad, knocking out its online banking services and cash machines. Iranian state media acknowledged the damage. The group also breached Nobitex, Iran's largest cryptocurrency exchange, popular with locals for transferring money overseas. The hackers extracted about $100 million in funds and forced the platform to shut down, according to the exchange. Iran's government pulled the plug on much of the country's online activities to prevent further attacks and keep a lid on dissent. Non-Iranian websites were blocked. Citizens were warned against using foreign phones or messaging platforms that it claimed could collect audio and location data for Israeli spies. Government officials were banned from using laptops and smartwatches. Predatory Sparrow said the two hacks were directed against the 'financial lifelines" of the Islamic Revolutionary Guard Corps, the most powerful faction of Iran's military that also controls swaths of the economy. 'Noble people of Iran! Withdraw your funds before it is too late," it tweeted. Both targeted companies remain hobbled. Nobitex said it faced serious challenges in restoring services and was aiming to relaunch trading this coming week. Some Bank Sepah users say online they still aren't receiving deposits. The group didn't say if it was acting on behalf of Israeli authorities. 'The group's sophistication, target selection and geopolitical messaging fit the profile of an Israel-aligned, state-sponsored cyber actor," said Deddy Lavid, chief executive of Cyvers, a Tel Aviv-based cybersecurity firm. Predatory Sparrow didn't respond to requests for comment sent to the administrator of its Telegram group. The cyberattacks hit an economy already battered by U.S. sanctions that bar the purchase of Iran's oil or interactions with its banks. Iran's economy is highly dependent on a select few trading partners, notably China. Annual inflation runs above 40%, according to the World Bank. A constant flight of skilled workers has also throttled Iran's economic growth. Israel confirmed a cease-fire with Iran on Tuesday. But cybersecurity experts and Israeli officials expect the cyberwarfare to continue. 'Israel will likely keep launching precision cyberstrikes against the regime's power centers," said Lavid. Officials at Israel's National Bureau for Counter-Terror Financing said they didn't have information on links between Predatory Sparrow and Israeli authorities. They said Israel was broadly targeting the economic infrastructure that allowed Iran to finance its military and proxies, imposing sanctions earlier this month on its central bank and other banks used by the IRGC. The NBCTF, which is overseen by the defense ministry, plans to issue orders to exchanges outside Iran to help it seize more of Nobitex's crypto holdings. It has identified a further $150 million in funds held by Nobitex, the officials said. Pro-Iran cyber groups have hit back, targeting Israeli government websites with denial-of-service attacks, in which hackers aim to overwhelm computers that route internet traffic with a flood of requests, and sending phishing messages to Israelis in a bid to compromise their phones. The Israel National Cyber Directorate said Iran's cyberattacks hadn't caused damage in recent weeks. Paranoia swept through the Iranian population as the attacks, both physical and cyber, mounted. 'It's better to cut [the internet] off. Israel can see everything," said Mohammad Ghorbaniyan, a Tehran-based money changer whom the U.S. sanctioned several years ago for allegedly aiding Iranian hackers, an accusation he denies. The Bank Sepah hack last Tuesday halted payments, including salaries owed to military retirees, according to Fars News Agency, which is controlled by the IRGC. Many of its cash machines stopped working. The U.S. Treasury Department said last year that Bank Sepah, which has branches on Iranian military bases, helps Iran's defense ministry pay foreign suppliers via a sprawling shadow-banking network. Nobitex went offline the next day. The Tehran-based crypto exchange has processed transactions in excess of about $22 billion for users since its 2017 launch, according to blockchain research firms and the officials from Israel's NBCTF. 'This attack had political motives to create emotional distress and damage the Iranian people's property," Nobitex's chief executive, Amir Rad, said in a video posted on its Telegram channel. As in Russia and other countries cut off from international finance, cryptocurrencies, in particular dollar-pegged stablecoins such as tether, have emerged as a vital workaround in Iran, providing a medium through which users can shift money between local and foreign banks. Nobitex's 11 million customers use the platform to swap Iranian rials for tether, which they can convert into other traditional currencies abroad. Rad has said on his LinkedIn account that Nobitex's goal is to allow Iranians to trade crypto despite 'the shadow of sanctions." 'Nobitex has been the main option for the Iranians to skip the sanctions," said Amit Levin, a former Israeli prosecutor and ex-investigator at the Binance crypto exchange who now advises companies on financial-crime compliance. The Islamic Revolutionary Guard Corps had also turned to Nobitex for international payments, according to the Israeli officials and blockchain researchers. Crypto analytics firm Elliptic has found that two IRGC operatives, whom the U.S. accused of conducting ransomware attacks on American companies, used Nobitex to make transfers. Rad said he didn't believe that the IRGC was moving money through Nobitex because he operated a transparent platform that was closely monitored. Predatory Sparrow has been wreaking havoc on Iran since at least 2021. In earlier hacks, the group disabled gas-station payment systems across the country and triggered a fire at an Iranian steel plant. For their operation against Nobitex, the hackers managed to obtain the keys for the exchange's cryptocurrency wallets, which were held by key personnel within the company, said Rad. Predatory Sparrow then 'burned" the stolen $100 million by sending the tokens to other digital wallets the group itself couldn't access. These wallets' addresses, which are made up of long strings of numbers and letters, contained profane phrases like 'F—IRGCterrorists." Nobitex's initial investigation into the breach indicated that Israel's government had likely supported it, Rad said, though he declined to provide proof of his claim. He said Nobitex was a private, independent company with no affiliation to the Iranian state, including the IRGC. Write to Angus Berwick at
Wall Street Journal
18 hours ago
- Business
- Wall Street Journal
How Israel-Aligned Hackers Hobbled Iran's Financial System
While Israel and the U.S. were bombing Iran's nuclear sites, another battlefield emerged behind the scenes: the financial infrastructure that keeps Tehran connected to the world. Israeli authorities, and a pro-Israeli hacking group called Predatory Sparrow, targeted financial organizations that Iranians use to move money and sidestep the U.S.-led economic blockade, according to Israeli officials and other people familiar with the efforts. U.S. sanctions, imposed off-and-on for decades due to Tehran's nuclear program and support for Islamist groups, have aimed to cut Iran off from the international financial system.
TechCrunch
3 days ago
- Politics
- TechCrunch
Homeland Security warns of Iran-backed cyberattacks targeting US networks
In Brief A bulletin issued Sunday by U.S. Homeland Security said it expects to see Iranian government-backed hackers conduct attacks against U.S. networks, amid the ongoing conflict between the U.S. and Israel, and Iran. The National Terrorism Advisory System bulletin said low-level cyberattacks by hacktivists are 'likely,' adding that hacktivists and government-linked hackers 'routinely target' poorly secured U.S. networks and internet-connected devices to cause disruption. The bulletin was published days after a series of U.S. and Israeli air strikes targeted Iran's nuclear program, which appeared to coincide with destructive hacks carried out by a pro-Israel hacking group, dubbed Predatory Sparrow. The hackers took out one of Iran's top banks and destroyed millions in cryptocurrency held by the country's largest crypto exchange. Following the initial round of Israeli air strikes, the Iranian government confirmed it shut down the country's internet to protect against cyberattacks. Iran is known for its offensive cyber capabilities, including long-running espionage operations targeting senior U.S. politicians and government officials, as well as disruptive cyberattacks designed to steal data from businesses and tech giants, often by using known vulnerabilities or stolen passwords.
WIRED
21-06-2025
- Politics
- WIRED
Israel Says Iran Is Hacking Security Cameras for Spying
Amid Israeli airstrikes this week and the imminent threat of further escalations by the United States, Iran started severely limiting internet connectivity for its citizens, limiting Iranians' access to crucial information and intentionally pushing them toward domestic apps that may not be secure. Meanwhile, the Israel-tied hacking group known as Predatory Sparrow is waging cyberwar on Iran's financial system, attacking Iran's Sepah Bank and destroying more than $90 million in cryptocurrency held by the Iranian crypto exchange Nobitex. With the US still reeling from last weekend's violent shooting spree in Minnesota targeting Democratic state lawmakers and their families, an FBI affidavit indicates that the suspected shooter allegedly used data broker sites to find targets' addresses and potentially other personal information about them. The finding highlights the potential dangers of widely available personal data. This week, WIRED published its How to Win a Fight package, which includes our roundup of tools for tracking the Trump administration's attacks on civil liberties, plus the most up-to-date versions of our guides to protecting yourself from government surveillance, protesting safely in the age of surveillance, and protecting yourself from phone searches at the US Border. While you're at it, don't forget to print your own copy of the How to Win a Fight zine! Better yet, print two and leave one at your local coffee shop or library. And there's more. Each week, we round up the security and privacy news we didn't cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there. Israeli officials said this week that Iran is compromising private security cameras around Israel to conduct espionage as the two countries exchange missile strikes after an initial Israeli barrage. A former Israeli cybersecurity official warned on public radio this week that Israelis should confirm that their home security cameras are protected by strong passwords or shut them down. 'We know that in the past two or three days, the Iranians have been trying to connect to cameras to understand what happened and where their missiles hit to improve their precision,' Refael Franco, the former deputy director general of the Israel National Cyber Directorate, said. Like many internet-of-things devices, surveillance cameras are notoriously vulnerable to takeover if they are not secured with strong account protections. They have previously been targeted in other conflicts for intelligence gathering. The Kyiv Post reported this week that hackers from Ukraine's Main Intelligence Directorate (HUR) launched a cyberattack against Russian internet service provider Orion Telecom that disabled 370 servers, took down roughly 500 network switches, and wiped backup systems to hinder recovery. The attacks reportedly caused internet and television outages. Orion Telecom reportedly said that it was recovering from a large DDoS attack and would quickly restore service. The attack came on June 12, the national holiday known as Russia Day. 'Happy holiday, disrespectful Russians," the attackers wrote in a message circulated on Telegram groups. "Soon you'll be living in the Stone Age—and we'll help you get there. Glory to Ukraine.' The attackers claim to be part of Ukraine's BO Team hacking group. Sources told the Kyiv Post that Russian security agencies working on the country's war against Ukraine use Orion Telecom and were affected by the connectivity outages. Bloomberg reported this week that the satellite communication firm Viasat discovered a breach earlier this year perpetrated by China's Salt Typhoon espionage-focused hacking group. In early December, US authorities revealed that Salt Typhoon hackers had embedded themselves in major US telecoms, including AT&T and Verizon. After revelations last year of the group's extensive telecom hacking spree in the US and elsewhere, WIRED reported in February that Salt Typhoon was still actively breaching new victims. Viasat says it has been cooperating with federal authorities to investigate its breach. The United Kingdom's Information Commissioner's Office (ICO) said this week that it issued a £2.31 million ($3.1 million) fine to the beleaguered genetic testing company 23andMe as a result of the company's damaging 2023 data breach. Attackers were able to access user accounts and their data using stolen login credentials, because at the time 23andMe did not require that users set up two-factor authentication, which the ICO says violated the UK's data protection law. The company has since mandated this protection for all users. More than 155,000 UK residents had their data stolen in the breach, according to the ICO, which said that 23andMe 'did not have additional verification steps for users to access and download their raw genetic data' when the breach occurred.
Al Bawaba
20-06-2025
- Politics
- Al Bawaba
Iran hacks Israeli home security cameras in intelligence operation
Published June 20th, 2025 - 06:26 GMT ALBAWABA - Bloomberg reported that Iran has been breaking into private home security cams all over Israel to get real-time information. The war between Iran and Israel is now in its second week. The story makes me worry again about how protection holes are being used during current Franco, who used to be the deputy head of Israel's National Cyber Directorate, went on public radio to tell people: "Shut down your home security cameras or change your passwords immediately." This was in response to recent Iranian ballistic missile attacks that damaged several high-rise buildings in Tel who is now the CEO of cybersecurity crisis company Code Blue, said that Iranian agents have been trying to get into internet-connected surveillance systems over the past few days to check how accurate rocket hits are and make plans for future attacks. The conflict between Israel and Iran has spread to online, where attacks are getting stronger along with real attacks. A group of hackers supporting Israel called Predatory Sparrow said they were behind recent hacks that shut down a major Iranian bank and got into a local bitcoin exchange. In reaction, IRIB, Iran's state television, said that Israel had started a large-scale hack on Iran's most important assets. As part of Iran's strategy operations, the National Cyber Directorate of Israel stated that there have been more efforts to break into linked devices, especially security cams. A spokesman said, "These attempts have been going on all through the war and are happening more often now." 🚨🇮🇷💥🇮🇱 Iran has reportedly hacked internet-connected home security cameras across Israel to conduct surveillance and gather intelligence. — Defense Intelligence (@DI313_) June 20, 2025 Israel has officially banned the sharing of video of rocket impacts for security reasons, but some pictures are still making the rounds on social the meantime, Iran has started a campaign against what it sees as sabotage networks inside the country that it says are linked to Israel's Mossad intelligence agency. The Iranian government recently said that they had seized 14 drones, found secret companies that made drones, and stopped cars carrying robotic aircraft in several people were arrested in Lorestan Province on suspicion of working as Mossad spies. They were accused of sharing anti-government material online and stirring up Iranian intelligence broke up what they thought was an explosives production cell that was working in Alborz and Isfahan Provinces. The cell was apparently led by a Mossad agent who was caught in with its military and defense measures, Iran has had strict rules on the internet ever since the fighting started. Access to a lot of websites has been blocked in whole or in part. The government has told people to use connected gadgets less and be aware of possible digital weaknesses. These events show that the online aspect of the conflict between Iran and Israel is getting worse. The two countries are now at war on physical, digital, and mental fronts. © 2000 - 2025 Al Bawaba (
