Loading story…
Security researchers have attributed the March breach of the Los Angeles County Metropolitan Transportation Authority to an Iran-linked operation masquerading as the hacktivist group Ababil of Minab. Gambit Security said forensic evidence and infrastructure overlaps connect the activity to actors associated with Iran’s Ministry of Intelligence and Security, including clusters tracked as MuddyWater, Black Shadow, and Static Kitten. The attackers reportedly disrupted LA Metro’s payment environment, preventing riders from loading funds onto the agency’s mobile contactless payment app, while claiming they had stolen and deleted transit-system data.
According to the report, the intrusion combined automation, hands-on-keyboard activity, and ChatGPT-assisted scripting to target IT, application, virtualization, and backup systems. Researchers said the attackers deleted virtual machines, wiped disks, and exfiltrated at least 700 GB of emails and backups, forcing Metro to inspect roughly 1,400 servers during recovery. Gambit linked the same actor to destructive incidents affecting Tri-Rail, UNIMAC, and Vyncs, reinforcing warnings that Iranian state-linked operators are using fake hacktivist branding to conduct disruptive attacks against critical infrastructure.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
By 2026-05-27, Gambit Security said the operators linked to the LA Metro breach had also targeted additional victims in Israel, Turkey, Saudi Arabia, and other sectors. This expanded the known scope of the destructive campaign beyond the previously reported organizations.
Gambit Security said the same actor behind the LA Metro attack was also connected to destructive incidents affecting Tri-Rail, UNIMAC, and Vyncs, where backups were similarly deleted. The finding positioned the breach as part of a broader Iranian campaign using fake hacktivist branding.
On or before May 26, 2026, Gambit Security assessed that the LA Metro breach was conducted by Iranian government-linked operators tied to Iran's Ministry of Intelligence and Security rather than an independent hacktivist collective. The firm linked Ababil of Minab to infrastructure and tradecraft associated with clusters tracked as MuddyWater, Black Shadow, and Static Kitten.
On 2026-04-09, Ababil of Minab publicly claimed the LA Metro attack on Telegram and its website, posting screenshots, video, and statements alleging access to VMware vCenter, Microsoft IIS servers, and a rail yard management and train control display system. The group also claimed large-scale data wiping and exfiltration, though those figures were not independently verified.
In April 2026, U.S. government agencies warned that Iranian hackers were targeting American critical infrastructure. The warning provided broader context for the LA Metro incident and related activity.
After the attack, LA Metro reportedly had to inspect about 1,400 servers before restoring affected systems. Recovery took weeks as the agency worked to bring disrupted services back online.
Following the March 2026 breach, the group calling itself Ababil of Minab publicly claimed responsibility and said it had stolen and deleted data from LA Metro transit systems. The claim framed the incident as a hacktivist operation before later attribution shifted.
In March 2026, Los Angeles County Metropolitan Transportation Authority was hit by a cyberattack that disrupted its payment network and prevented riders from loading money onto the mobile contactless payment app. The attackers reportedly targeted IT, application, virtualization, and backup infrastructure, deleting virtual machines, wiping disks, and stealing at least 700 GB of emails and backups.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcetherecord.media
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcebankinfosecurity.com
Open sourcedataminr.com
Open sourceababilofminab.io
Open sourcecdn.prod.website-files.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. agencies warned that Iran could target **critical infrastructure** operators as researchers and policy analysts described a cyber ecosystem that blends state-directed activity with nominally independent hacktivist groups. CSIS said Tehran uses this structure to support espionage, sabotage, influence operations, and plausible deniability, citing the **CyberAv3ngers** intrusions into U.S. water and wastewater systems as a prominent example after U.S. authorities tied the activity to officials in the Islamic Revolutionary Guard Corps Cyber-Electronic Command. The same reporting linked Iranian state organs, including the **IRGC** and **MOIS**, to affiliated groups such as `APT33`, `APT35`, `APT34`/`OilRig`, and `MuddyWater`. The threat picture expanded as pro-Russia actors joined Iran-linked operations under **#OpIsrael**, with attacks reportedly including **DDoS**, claimed breaches, leaked CCTV footage, **SQL injection**, and data leaks against Israeli government, education, and municipal targets. Researchers said dozens of Russia-aligned and Iran-nexus actors appeared to be participating, while Radware separately reported retaliatory hacktivist DDoS activity tied to the regional conflict. U.S. officials and sector groups have monitored for spillover risk, warning that even if many operations are opportunistic or low sophistication, smaller U.S. infrastructure operators could still face disruptive, high-visibility attacks.
Jun 29, 2026
Researchers linked **Handala Hack** to Iran’s Ministry of Intelligence and Security as part of the broader **Void Manticore** cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on **Stryker**, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity. Investigators said the intrusions commonly began with **compromised VPN credentials**, followed by hands-on-keyboard movement over **RDP**, use of **NetBird** for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom **Handala Wiper**, **PowerShell-based wiping**, **VeraCrypt** encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including **Homeland Justice** and **Karma**, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.
Jun 29, 2026
Iranian state-aligned and affiliated cyber activity has expanded beyond traditional disruptive malware into a broader campaign of **hybrid operations** that combines espionage, reconnaissance, credential abuse, and destructive effects. Reporting describes a tactical shift from bespoke wipers toward **living-off-the-land** methods, including the compromise of highly privileged identities and the use of legitimate enterprise administration capabilities to issue remote-wipe actions at scale. At the same time, Iranian operators and aligned personas have been linked to sustained access into US organizations in sectors including banking, aviation, defense-adjacent industries, and healthcare, while also targeting internet-connected surveillance infrastructure in the Middle East for intelligence collection and battlefield awareness. The activity is unfolding alongside a wider surge in hostile traffic associated with the regional conflict, with major increases in infrastructure scanning, automated reconnaissance, credential harvesting, and DDoS preparation against critical businesses, especially **banking and fintech**. One report highlights **Handala/Void Manticore** as emblematic of the disruptive trend, while another ties **MuddyWater** to persistent footholds in US networks and notes exploitation of camera vulnerabilities such as `CVE-2017-7921` and `CVE-2021-33044`. Together, the reporting indicates that Iranian cyber operations remain active and adaptive, using proxy infrastructure, compromised identities, and exposed edge devices to sustain pressure on commercial and strategic targets without relying solely on custom malware.
Jun 29, 2026