Iran steel mills cyberattack (Predatory Sparrow)

On June 27, 2022, the pro-Israel persona Predatory Sparrow (Persian Gonjeshke Darande) compromised industrial control systems at three of Iran's largest steel manufacturers and triggered a physical sabotage event at Khouzestan Steel Company in Ahvaz. CCTV footage released by the group shortly afterward showed an overhead crane in the steel mill discharging a load of molten metal onto the factory floor, igniting a fire and damaging equipment; an HMI display visible in the same footage indicated the attackers had reached the production-control plane. Production at Khouzestan was halted; Mobarakeh Steel and Hormozgan Steel Company also reported interruption, though independent confirmation of physical damage at those sites is weaker. Predatory Sparrow framed the operation as a response to Iranian regime aggression and stated they had timed the action to avoid worker injury; no injuries were publicly reported. The attack is the first publicly known cyber operation to inflict visible physical damage on heavy-industrial production equipment since the 2010 Stuxnet operation against Natanz, and is the canonical reference for ICS-aware, OT-impactful state-aligned hacktivism.

Production line halt at Khouzestan Steel; equipment damage and localized fire; reduced output at Mobarakeh and Hormozgan; major reputational and political impact within Iran; doctrinal precedent for cyber-physical sabotage operations.