Israel-linked hackers paralyzed gas stations across Iran

Israel-linked hackers paralyzed gas stations across Iran

An Israeli hacker group known as Gonjeshke Darande (Predatory Sparrow) has taken responsibility for a cyberattack that caused widespread disruption on petrol stations across Iran.

According to Iran’s oil minister, Javad Owji, 70% of the country’s petrol stations were impacted. Petrol station association spokesperson, Reza Navar, said that a “software problem” was the cause of the outages.

“We, Gonjeshke Darande, carried out another cyberattack today, taking out a majority of the gas pumps throughout Iran. This cyberattack comes in response to the aggression of the Islamic Republic and its proxies in the region,” the group said in a series of post on X (formerly Twitter).

The hackers said that while they were able to disrupt the operation of all petrol stations in Iran, some of the outfits were left unharmed in order to limit potential damage to emergency services.

“We delivered warnings to emergency services across the country before the operation began, and ensured a portion of the gas stations across the country were left unharmed for the same reason, despite our access and capability to completely disrupt their operation,” the group said.

The Predatory Sparrow hackers had in the past claimed cyberattacks against Iranian petrol stations, rail networks and steel factories.

Earlier this month, an Iran-backed hacker group known as Cyber Av3ngers affiliated with the Islamic Revolutionary Guard Corps breached multiple US-based WWS (Water and Wastewater Systems) facilities that operate Israeli-made Unitronics Vision Series PLCs with an HMI likely by compromising internet-accessible devices with default passwords (1111).


Back to the list

Latest Posts

Cyber Security Week in Review: June 13, 2025

Cyber Security Week in Review: June 13, 2025

In brief: Microsoft fixes zero-day exploited by the Stealth Falcon APT, the Graphite spyware targets journalists via an iMessage exploit, and more.
13 June 2025
Coordinated brute-force campaign targets Apache Tomcat Manager interfaces

Coordinated brute-force campaign targets Apache Tomcat Manager interfaces

The campaign, first observed on June 5, involves brute-force login attempts originating from hundreds of unique IP addresses.
12 June 2025
ConnectWise rotates digital certificates due to security risks

ConnectWise rotates digital certificates due to security risks

The company said that this is a preventive action and not related to any recent security incident.
11 June 2025