Israel-linked hacking group claims attack on Iranian gas pumps | CyberScoop<\/title> <meta name=\"description\" content=\"The incident comes as Iranian-backed Houthi fighters step up attacks on commercial shipping vessels in the Red Sea.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/israel-iran-cyberattack-houthi\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Israel-linked hacking group claims attack on Iranian gas pumps\"> <meta property=\"og:description\" content=\"The incident comes as Iranian-backed Houthi fighters step up attacks on commercial shipping vessels in the Red Sea.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/israel-iran-cyberattack-houthi\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2023-12-18T20:28:36+00:00\"> <meta property=\"article:modified_time\" content=\"2023-12-19T21:15:50+00:00\"> <meta name=\"author\" content=\"eliasgroll\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1701905043g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress-next\/dist\/css\/related-posts-block-styles.min.css?m=1701205643g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1702656561g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=7dab012cdc88b5676610\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/78587\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.4.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=78587\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fisrael-iran-cyberattack-houthi%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fisrael-iran-cyberattack-houthi%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-78587 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/israel-iran-cyberattack-houthi\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"24.885041551247\">\n<div class=\"single-article__header-content\" readability=\"29.744394618834\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/geopolitics\/\"> <span>Geopolitics<\/span> <\/a> <\/li>\n<\/ul>\n<p> The incident comes as Iranian-backed Houthi fighters step up attacks on commercial shipping vessels in the Red Sea. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> People wait at a gas station in Tehran on December 18, 2023 after a cyberattack disrupted fuel distribution. (Photo by ATTA KENARE \/ AFP) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"40.469513490546\"><body readability=\"81.617051678971\"><\/p>\n<p>A sophisticated hacking group linked to Israel claimed responsibility on Sunday for carrying out a cyberattack that disrupted a significant portion of Iran\u2019s gas stations. <\/p>\n<p>The group known as Predatory Sparrow wrote in a statement to X, the social media platform formerly known as Twitter, that the attack had knocked out \u201ca majority of the gas pumps throughout Iran\u201d and that it came \u201cin response to the aggression of the Islamic Republic and its proxies in the region.\u201d<\/p>\n<p>\u201cKhamenei, playing with fire has a price,\u201d the post added, referring to Iran\u2019s supreme leader. <\/p>\n<p>Iran\u2019s oil minister, Javad Owji, <a href=\"https:\/\/www.reuters.com\/world\/middle-east\/software-problem-disrupts-iranian-gas-stations-fars-2023-12-18\/\">told<\/a> Iranian state TV that as many as 70% of the country\u2019s gas stations had been disrupted in the incident, which is the second time in the past two years that Predatory Sparrow has disrupted gasoline supplies in Iran. An Israeli government spokesperson declined to comment on the incident during a Monday briefing. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Following Hamas\u2019s Oct. 7 attack on Israel, a flurry of hacktivist groups on both sides of the conflict have attempted to take down and deface websites, but operations linked to the conflict have been mostly <a href=\"https:\/\/cyberscoop.com\/iran-reactionary-opportunistic-hamas-israel\/\">opportunistic and exaggerated in impact.<\/a> Sunday\u2019s incident in Iran appears to be the first cyberattack since the current round of fighting began to have major physical consequences. <\/p>\n<p>The attack comes against the backdrop of growing tensions in the Middle East as fighting continues between Israel and Hamas. Iranian-backed Houthi fighters have in recent weeks carried out a string of attacks targeting commercial shipping vessels in the Red Sea, prompting some major oil producers <a href=\"https:\/\/www.theguardian.com\/business\/2023\/dec\/18\/bp-halts-oil-and-gas-shipments-red-sea-shipping\">to halt oil shipments via the Suez Canal<\/a>. <\/p>\n<p>In an online message to CyberScoop on Tuesday, a representative of the group said that \u201cwe attacked Iran because of their aggression in the region by using proxies like the Houthis, Hezbollah and more.\u201d <\/p>\n<p>U.S. destroyers deployed to the Red Sea have shot down a string of Houthi drones in recent weeks following drone attacks on commercial shipping vessels. Some vessels transiting the region have <a href=\"https:\/\/twitter.com\/bradyafr\/status\/1736792187487268908\">taken to broadcasting<\/a> that they are traveling with armed guards aboard in an attempt to deter attacks, and U.S. officials are expected to announce the formation this week of a naval task force to protect ships in the region. <\/p>\n<p>Houthi fighters have <a href=\"https:\/\/www.reuters.com\/world\/middle-east\/ukmto-ambrey-report-possible-explosion-south-yemens-port-mokha-2023-12-18\/#:~:text=The%20Houthis%20have%20pledged%20to,about%20its%20sea%20%22operations%22.\">pledged to carry out attacks<\/a> on what they have described as commercial vessels linked to Israel as part of a retaliatory campaign carried out in solidarity with Hamas. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Predatory Sparrow has not declared its affiliation with Israel, but the group is widely believed to be a persona created by Israeli security services as part of its long-running conflict with Iran. The group was linked to <a href=\"https:\/\/archive.ph\/30DGG\">an attack in October 2021<\/a> that also disrupted the supply of automotive fuel. Last year, the group <a href=\"https:\/\/cyberscoop.com\/gonjeshke-darande-israel-hackers-iran-steel-hacktivist\/\">struck steel manufacturing plants<\/a> in Iran. <\/p>\n<p>Anonymous U.S. defense officials <a href=\"https:\/\/archive.ph\/bx6EU\">have been quoted saying<\/a> that they believe the 2021 attack by Predatory Sparrow was the work of Israel. <\/p>\n<p>\u201cThis group has been one half of a cyber conflict that was going on within Iran and Israel before the most recent violence erupted,\u201d said John Hultquist, the chief analyst at Mandiant Intelligence. <\/p>\n<p>Predatory Sparrow is notable for the way it calibrates its attacks. In a statement to X, Predatory Sparrow said \u201cthis cyberattack was conducted in a controlled manner while taking measures to limit potential damage to emergency services.\u201d The group said it had \u201cdelivered warnings to emergency services across the country before the operation began, and ensured a portion of the gas stations across the country were left unharmed for the same reason, despite our access and capability to completely disrupt their operation.\u201d <\/p>\n<p>Efforts to limit the impact of attacks in this manner \u2014 requiring a measure of technical sophistication and in all likelihood a legal team vetting operations \u2014 is a major reason why experts believe the group to be the work of Israeli security services. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p><em>AJ Vicens contributed reporting to this article. <\/em><\/p>\n<p><strong>Updated Dec. 19, 2023: <\/strong><em>This article has been updated with comment from a representative of Predatory Sparrow. <\/em><\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.9408284023669\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/12\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps-1.jpg?w=640&ssl=1\" alt=\"Elias Groll\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Elias Groll<\/h4>\n<p> Elias Groll is a senior editor at CyberScoop. He has previously worked as a reporter and editor at Foreign Policy, covering technology and national security, and at the Brookings Institution, where he was the managing editor of TechStream and worked as part of the AI and Emerging Technology Initiative. He is a graduate of Harvard University, where he was the managing editor of The Harvard Crimson. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/israel-iran-cyberattack-houthi\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Israel-linked hacking group claims attack on Iranian gas pumps |<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1338,302,1058,1188,513,514,1060,1337],"tags":[1340,306,1061,1189,517,518,1063,1339],"class_list":["post-2254","post","type-post","status-publish","format-standard","hentry","category-gaza","category-geopolitics","category-hamas","category-hamas-israel-cyber-ops","category-iran","category-israel","category-predatory-sparrow","category-yemen","tag-gaza","tag-geopolitics","tag-hamas","tag-hamas-israel-cyber-ops","tag-iran","tag-israel","tag-predatory-sparrow","tag-yemen"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/gaza\/\" rel=\"category tag\">Gaza<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/hamas\/\" rel=\"category tag\">Hamas<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/hamas-israel-cyber-ops\/\" rel=\"category tag\">Hamas-Israel cyber ops<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/iran\/\" rel=\"category tag\">Iran<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/israel\/\" rel=\"category tag\">Israel<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/predatory-sparrow\/\" rel=\"category tag\">Predatory Sparrow<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/yemen\/\" rel=\"category tag\">Yemen<\/a>","tag_info":"Yemen","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2254","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=2254"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2254\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=2254"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=2254"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=2254"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":2254,"date":"2023-12-18T20:28:36","date_gmt":"2023-12-18T20:28:36","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=78587"},"modified":"2023-12-18T20:28:36","modified_gmt":"2023-12-18T20:28:36","slug":"israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2023\/12\/18\/israel-linked-hacking-group-claims-attack-on-iranian-gas-pumps\/","title":{"rendered":"Israel-linked hacking group claims attack on Iranian gas pumps"},"content":{"rendered":"