Iranian Railways 'MeteorExpress' wiper attack

On 9 July 2021, Iran's national railway network was paralyzed by a previously unknown destructive malware that researchers named Meteor — an attack dubbed "MeteorExpress" for its combination of technical sophistication and theatrical trolling.

What happened

The malware swept across the IT systems of the Islamic Republic of Iran Railways and the Ministry of Roads and Urban Development. Station departure boards were defaced to show messages about "long delays because of cyberattack" and instructed travelers to call 64411 for information — the publicly known phone number for the office of Supreme Leader Ali Khamenei, a deliberate humiliation of the regime. The ministry's website was taken offline, and hundreds of trains were delayed or canceled amid what Iranian media described as unprecedented chaos.

The malware

Analysts at SentinelLabs reverse-engineered a three-part toolkit deployed via batch scripts and password-protected RAR archives (password hackemall):

• Meteor — the core wiper: it wiped the filesystem according to an encrypted configuration, deleted shadow copies to block recovery, detached machines from the Windows domain, corrupted boot sectors, and changed passwords.
• mssetup.exe — a screen-locker that froze workstations.
• nti.exe — a component that corrupted the master boot record (MBR), rendering machines unbootable.

The Meteor binary had been compiled on 17 January 2021, roughly six months before deployment, and showed signs of being engineered for reuse — suggesting a deliberate, well-resourced operation rather than opportunistic crime.

Impact

• Iran's railway operations were disrupted nationwide; trains were halted, delayed, or canceled.
• Affected machines were wiped and made unbootable, forcing manual recovery.
• This was a destructive incident — not ransomware — with no data exfiltration or ransom: the objective was disruption and political embarrassment.

Attribution

SentinelLabs could not initially tie Meteor to any known actor. Subsequent research by Check Point linked the operation to a hacktivist persona called "Indra", which had previously targeted Iranian-aligned entities in Syria, suggesting an anti-regime actor rather than a nation-state — though attribution remains unconfirmed. The attack came amid a wider wave of strikes on Iranian infrastructure later associated with the Predatory Sparrow group.

Why it matters

MeteorExpress demonstrated that a single custom wiper could shut down a nation's rail system and that attackers were increasingly pairing destruction with psychological operations — mocking Iran's leadership directly on public infrastructure. It became a template for the infrastructure-disruption campaigns that would hit Iran's fuel network and steel plants over the following year.