Los Angeles transit system hack blamed on Iranian attackers - but they might not have worked alone

Date:
Wed, 27 May 2026 20:05:00 +0000

Description:
Some researchers believe the attack was the work of the Iranian government, not hacktivists.

FULL STORY
The March 2026 cyberattack on the Los Angeles transit
system was not the work of hacktivists, but rather Iranian state-sponsored threat actors, after experts from Gambit Security claimed to have found evidence connecting the breach to the government in Teheran.

Two months ago, the Los Angeles County Metropolitan Transportation Authority (LACMTA) detected unauthorized activity on its internal network and shut down parts of its computer systems to contain the breach. The attack disrupted
some customer-facing services, including arrival information displays and TAP card reloading systems, although trains and buses continued operating normally. Sometime later, a pro-Iranian hacking group calling itself Ababil
of Minab claimed responsibility for the breach, saying they stole hundreds of gigabytes of internal data from the transit agency. Gambit now claims that
the attackers walked away with 700GB of emails, backups , and other data, after finding the stolen files exposed online.

Iranian hackers are targeting American critical infrastructure causing 'disruptive effects within the United States'.

Who are Ababil of Minab?

The researchers also said they followed the
trail of evidence back to a server that was previously seen being used in other Iranian state-sponsored hacking campaigns.

According to Reuters , many cybersecurity researchers suspected that the LACMTA attack was the work of the Iranians. Eyal Sela, Gambit's director of threat intelligence, said that the companys research now adds forensic evidence to support these claims.

Ababil of Minab is a lesser-known group that first emerged a few weeks after the LACMTA incident. The name references the US air strike on an Iranian school that happened at the very beginning of the latest US/Israel-Iran conflict, in which 175 people, mostly children, were killed.

In its writeup, TechCrunch said that if Gambits assumptions are correct, Ababil of Minab would be the latest in a series of fake hacktivist groups
that are working for the Iranian government. Before this group, there was Handala, which struck Stryker and wiped thousands of company systems and employee devices.

Via TechCrunch

Link to news story: https://www.techradar.com/pro/security/los-angeles-transit-system-hack-blamed- on-iranian-attackers-but-they-might-not-have-worked-alone

$$
--- MultiMail/DOS
* Origin: Capitol City Hub (1:2320/105)