Iranian steel plants cyber-sabotage

In the early hours of 27 June 2022, the hacktivist group Predatory Sparrow (Gonjeshke Darande) compromised the industrial control systems of three of Iran's largest steel producers — and, in a rare instance of a cyberattack causing visible physical damage, released CCTV footage of a machine spewing molten steel and fire across a factory floor.

What happened

The group said it struck Mobarakeh Steel Company (Isfahan province), Khouzestan Steel Company (near Ahvaz in the southwest), and Hormozgan Steel Company (south). The intrusions occurred between roughly midnight and 6 a.m., when the factory floor was largely empty. At Khouzestan Steel, a production machine malfunctioned, causing a vat of molten steel to spill and ignite a fire. Predatory Sparrow released surveillance video timestamped between 03:08 and 03:28 showing the incident and claimed it had taken pains to ensure no workers were endangered — though Wired later reported staff narrowly avoided being hit by the molten metal.

Khouzestan Steel acknowledged that its production line had ground to a halt, attributing the stoppage to a "technical problem" and an electricity-supply issue while it investigated.

Impact

• Production at Khouzestan Steel was temporarily halted; the other two plants reported disruption.
• The attack produced physical, kinetic damage via cyber means — placing it alongside Stuxnet and the 2014 German steel-mill incident in the small set of confirmed cyber-physical sabotage events.
• Predatory Sparrow subsequently leaked tens of thousands of internal emails it claimed demonstrated the steelmakers' ties to Iran's military and Islamic Revolutionary Guard Corps, framing the operation as a response to "aggression."

Attribution

Predatory Sparrow claimed responsibility directly, consistent with its earlier 2021 operations against Iran's railways and fuel-distribution network. The group is widely assessed by analysts and Western officials to be linked to Israel, though no government has formally claimed it. Legal scholars at the NATO CCDCOE analyzed the operation as a case study in whether such ICS sabotage crosses the threshold of a prohibited use of force under international law.

Why it matters

The steel-plant attack is one of the very few cyber operations to cause demonstrable physical destruction of heavy industrial equipment, captured on video. It marked an escalation from the disruption-and-embarrassment playbook of the railway and fuel attacks toward deliberate, recorded kinetic effects — while the careful timing to avoid casualties signaled an attacker managing the line between sabotage and a strike that could kill, and the international-law debate it triggered continues to shape norms around cyber-physical warfare.