Iranian petrol stations hit by cyber attack allegedly linked to Israeli hacker group

Iran has accused a hacking group with alleged ties to Israel of carrying out a cyber attack that resulted in service disruptions at petrol stations throughout the country on Monday. The Israeli hacker group Gonjeshke Darande or Predatory Sparrow also claimed responsibility for hacking Iran’s gas stations.

Iran’s oil minister, Javad Owji, confirmed that a cyberattack was responsible for the widespread disruption of petrol stations nationwide. 

“Owji had earlier told Iranian state TV that services had been disrupted at about 70% of Iran’s petrol stations and that outside interference was a possible cause,” Reuters reported. He later said 1,650 petrol stations were operational. The ministry supervises 3,800 petrol stations.

In a statement released on Telegram, the Gonjeshke Darande group said, “We, Gonjeshke Darande, carried out another cyberattack today, taking out a majority of the gas pumps throughout Iran. This cyberattack comes in response to the aggression of the Islamic Republic and its proxies in the region. Khamenei, playing with fire has a price. A month ago we warned you that we’re back and that we will impose cost for your provocations. This is just a taste of what we have in store.”

Commenting on the cyberattack, Christopher Warner, a senior security consultant for OT Security – GRC at GuidePoint Security wrote in an emailed statement that confirmation of the claim comes from Iranian state TV and Israeli local media. 

“Iran’s Oil Minister revealed on state TV those services at around 70% of the nation’s gas stations were impacted, attributing the disruptions to potential external interference,” according to Warner. “Presently, 30% of gas stations are operational, and efforts are underway to gradually resolve the service disruptions.”

Warner also noted that “this incident serves as an example of the global cyber threats that warrant our attention in the United States. The ongoing cyber-attacks on critical infrastructure worldwide underscore the necessity for vigilance, emphasizing the urgency to bolster our defenses and shield against potential threats to our own critical infrastructure.”

A couple of weeks back, the U.S. Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), and the Israel National Cyber Directorate (INCD) released a Cybersecurity Advisory (CSA). The advisory draws attention to ongoing malicious cyber activity targeting operational technology (OT) devices. Specifically, the advisory focuses on the actions of Advanced Persistent Threat (APT) cyber hackers affiliated with the Iranian Government’s Islamic Revolutionary Guard Corps (IRGC).

Anna Ribeiro

Industrial Cyber News Editor. Anna Ribeiro is a freelance journalist with over 14 years of experience in the areas of security, data storage, virtualization and IoT.