Predatory_Sparrow__2021__Indra_Hackers_Behind_Recent_Attacks_on_Iran_-_Check_Point_Research.pdf

Threat actor Indra conducted coordinated cyber attacks against Iran's railways and transportation infrastructure using sophisticated multi-stage wiper malware variants (Meteor, Stardust, Comet), including a complex executable and batch/VBS-based delivery chains, anti-forensic measures, and boot/log destruction. The study links these Iranian operations to prior Syria-targeted campaigns, provides IoCs and YARA signatures, and highlights Indra’s public activities and claims across social platforms.