Loading threat actor…
Ababil of Minab is a pro-Iranian threat persona that emerged in late March 2026 and has been assessed by multiple security reports as a front identity for Iranian state-linked operations, specifically activity tied to Iran’s Ministry of Intelligence and Security (MOIS). The actor has been linked to the broader Iranian intrusion cluster variously tracked as Black Shadow, Static Kitten, and MuddyWater. It presents itself as a hacktivist group, but reported tradecraft, infrastructure overlaps, and victimology are consistent with a state-directed disruptive and destructive campaign rather than an independent activist collective. The actor is known for claiming and conducting intrusions against organizations in the United States, Israel, Saudi Arabia, and Turkey. Confirmed or widely reported victim sectors include public transit, logistics and vehicle tracking, media, education, insurance, and other internet-exposed commercial organizations. A prominent operation targeted the Los Angeles County Metropolitan Transportation Authority, where the intrusion disrupted parts of the transit network and payment-related services without halting train or bus operations. Related activity has also been reported against South Florida’s Tri-Rail, Vyncs, and Saudi firm UNIMAC, alongside additional Israeli and Turkish victims. Ababil of Minab combines data theft with destructive post-compromise actions. Reported behaviors include exfiltration of large data volumes; deletion of SQL Server databases; destruction of backups; wiping or reformatting storage volumes and partitions; deletion of virtual machines through virtualization management platforms; and file-system damage intended to hinder recovery. The actor has used both automated scripts and hands-on-keyboard administration after gaining elevated access, indicating an operational model that moves quickly from intrusion to recovery-layer sabotage. Custom exfiltration tooling and bespoke malware have been reported in connection with the campaign, including encrypted chunked upload mechanisms and tooling capable of collecting files from local and network-accessible storage. Observed tradecraft also includes opportunistic targeting of exposed systems, abuse of stolen credentials, exploitation of known vulnerabilities, staging of stolen data on external infrastructure, and public amplification of operations through Telegram and other propaganda channels. The persona has used dramatic public claims, screenshots, and videos to frame operations as hacktivist retaliation, including claims of attacks on critical infrastructure and operational technology-adjacent environments. This messaging pattern aligns with a broader Iranian practice of using cut-out personas to obscure state responsibility while maximizing psychological and political impact. Ababil of Minab is best understood as a destructive, espionage-adjacent Iranian cyber front that blends exfiltration, disruption, and influence messaging. Its operations show particular interest in public-sector and critical-service targets, but also extend opportunistically to private-sector organizations with weak external exposure or recoverable-value data and infrastructure.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
38 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
10 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-linked hacktivist actor conducting opportunistic attacks against exposed systems; described as compromising Vyncs, taking systems offline, and defacing its website.
Destructive intrusion and data exfiltration campaign targeting organizations in the United States, Israel, Saudi Arabia, and Turkey, including transportation, academia, media, and insurance entities. The group used exposed staging servers, custom upload tooling, credential theft, archive-based exfiltration, and destructive wiping actions.
Iran MOIS front persona associated with wiper attacks, targeting senior officials, and doxxing activity.
Destructive and data-theft campaign targeting transportation and other organizations, including LA Metro, using scripted and hands-on-keyboard deletion of virtual machines, partitions, and databases while presenting itself as a hacktivist persona.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.