On 27 June 2022 the persona calling itself Predatory Sparrow claimed attacks against three Iranian steel producers — Khouzestan Steel near Ahvaz, Mobarakeh Steel in Esfahan province and Hormozgan Steel in the south. The group published CCTV footage showing an overhead crane discharging molten metal onto a factory floor, starting a fire, with an operator interface visible in the same footage.
Production at Khouzestan was reported halted. The other two plants reported interruption, with weaker independent confirmation of physical damage. The group stated it had timed the operation to avoid injuring workers; no injuries were publicly reported.
Physical Damage Is Almost Absent From This Corpus
This database holds hundreds of files on data taken and services stopped. It holds almost none on things broken. The Viasat wiper at 22-0224 destroyed firmware and required physical replacement, which is the nearest equivalent, and even that is a device being bricked rather than a process being driven into a damaging state.
What this file records is a control system being operated — not disabled — to produce an outcome the plant was built to prevent. We filed the same category of reachability at 26-0727 and 26-0729, where water controllers were manipulated rather than merely stopped. The consequence there was service disruption. Here it was a fire.
The Attacker Published The Evidence
The footage came from the group, not from an investigation. That is unusual enough to be the second finding: an operation that wants the effect seen, and wants authorship attached to it.
We have recorded the same dynamic at 22-0322, where publicity on Telegram let Microsoft cut off a transfer, and at 22-0227. Spectacle is an operational choice with costs. Here the cost was accepted because the point of the exercise was demonstration — which is a statecraft objective, not a criminal one.
A Claim About Restraint
The group asserted it had acted to avoid harming workers. This desk cannot verify that and does not repeat it as fact.
It records the assertion because of what making it implies: an actor arguing about proportionality is an actor positioning itself as something other than a criminal, and expecting to be judged by a standard that applies to states. We filed the state-versus-crime boundary at 22-0508, where a president said his country was at war with a ransomware group, and the boundary is no clearer from this side.
Compiled from contemporaneous reporting and on the CCDCOE case documentation, listed below. Independent confirmation of physical damage is strongest for Khouzestan and weaker for the other two sites, which is recorded rather than smoothed over — and is the principal reason this file is graded medium. Predatory Sparrow is a persona; this desk does not attribute it to any state, and no state has been established as responsible. No footage is reproduced or linked. Corrections: corrections@forensicpost.com.