- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Iran(medium confidence)
- Motivation
- Sabotage; Sabotage and destruction
- Seen
- 2019
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0146 · predatory-sparrow
IranWhat it is
A self-proclaimed hacktivist group that carried out attacks against Iranian railway systems and against Iranian steel plants.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Mandiant
- UNC4368
- Other names
- Indra, Gonjeshk Darand, GonjeshkDarand, Gonjeshke Darande, MeteorExpress, گنجشک درنده
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Iran, Syria
- Sectors
- Critical manufacturing, Energy, Transportation, Transportation systems
Tools
The tools and malware families the sources tie to it.
- Comet
- Cyber Eye RAT
- CyberGate
- Predator Pain
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de