.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
Summary
COASTLIGHT has been conducting offensive cyber operations since at least June 2019. The group uses the BreakWin malware with wiper variants known as Meteor, Comet and Stardust. The threat group operates hacktivist personas including "Indra" and "Gonjeshke Darande" (aka Predatory Sparrow). Predatory Sparrow has demonstrated the capability to conduct targeted offensive operations against industrial control systems (ICS) and operational technology (OT) networks.
Despite attempts to disguise its operations as anti-Iranian regime hacktivism, COASTLIGHT's methods and attack sophistication suggest that it is an experienced and possibly state-sponsored group.
Despite attempts to disguise its operations as anti-Iranian regime hacktivism, COASTLIGHT's methods and attack sophistication suggest that it is an experienced and possibly state-sponsored group.
Contact us
Contact us directly whether your organization needs immediate assistance or
you want to discuss your incident readiness, response, and testing needs.