The LA Metro Attack Wasn’t Hacktivism. It Was a State Operation With a Costume On.

Pierluigi Paganini
May 27, 2026

Iran’s “hacktivist” group Ababil of Minab, which hit LA Metro and wiped terabytes of data, is forensically linked to Iran’s intelligence service MOIS.

In late March, a group calling itself Ababil of Minab posted videos and screenshots online claiming it had broken into the Los Angeles County Metropolitan Transportation Authority, wiped hundreds of terabytes of data, and stolen more than a terabyte of files. It framed itself as a pro-Iran hacktivist collective. Researchers at Israeli firm Gambit Security took one look at the infrastructure and didn’t buy it.

LA Metro confirmed the breach on April 2, 2026. The attack forced the authority to check hundreds of servers for signs of compromise before bringing them back online. Rail and bus services kept running, but internal operations were disrupted for weeks. The timing of the intrusion is visible in the attacker’s own footage: at 03:37 AM on March 17, LA Metro posted on X that service alerts were delayed and riders couldn’t load fares on the TAP Mobile App. That tweet went up hours after the attacker had already deleted virtual machines from LA Metro’s vCenter environment. The destruction wasn’t random clicking.

“The actor carried out destruction using two methods: scripted automation and hands-on keyboard. In the scripted mode, the operator runs a program that iterates through an inventory and issues the destructive command against each entry.” reads the report published by Gambit Security. “In the interactive mode, the operator opens the management consoles and operating system tools a legitimate administrator would use and deletes resources by pointing and clicking through them.”

The attacker opened vCenter, selected virtual machines, issued Power Off followed by Delete from Disk, and watched the task queue confirm each deletion. Then they moved to Windows guest VMs, opened Disk Management, and deleted partitions one by one, clicking through the OS warnings.

LA Metro wasn’t the only target. The same campaign hit the South Florida Regional Transportation Authority, a Saudi maintenance company called UNIMAC, and Vyncs, a consumer GPS vehicle tracking service. At UNIMAC, the attackers formatted storage volumes, deleted them, then created new volumes named “Minab” in their place. Not subtle. At Vyncs, they ran a custom Python script called main.py that iterated through a hardcoded list of 58 SQL Server instances, dropped every user database on each one, then manually deleted backup files and finally deleted the Windows operating system folder itself. The RDP session dropped mid-deletion, which confirmed the destruction had worked.

The attacker also used ChatGPT to refine the destruction script. In a video the group published, a browser tab briefly exposed a ChatGPT conversation where the operator was asking for help filtering system databases out of the enumeration so that DROP DATABASE would only hit user data. The recommended code pattern matched exactly what the script did at runtime. It’s a mundane detail, but it’s notable: an Iran-linked intelligence operation using consumer AI tooling to fix a bug in its wiper script.

The attribution to Iran came through forensic analysis of the attacker’s staging server. Gambit found that files had been transferred onto it from a second IP address, 31.172.87.20, which had previously served an SSL certificate for nefeshhope[.]com.

That domain was used in August 2025 as a fake trauma support portal targeting IDF soldiers, impersonating a legitimate mental health service to harvest personal information and deliver malware. The Israeli National Cyber Directorate took it down and attributed it to a known Iranian group. Additional analysis by ClearSky Cyber Security and researcher Simon Kenin linked the infrastructure to Black Shadow, an Iranian group operating on behalf of MOIS, Iran’s Ministry of Intelligence and Security.

“Our investigation found that Ababil of Minab is unlikely to be a new, standalone hacktivist crew, as they claim.” continues the report. “Forensic evidence ties the operation to infrastructure and activity associated with Black Shadow, an Iran-linked group, which was attributed by the Israel National Cyber Directorate to Iran’s Ministry of Intelligence and Security.”

Beyond the four public incidents, Gambit also identified additional victims on the attacker’s staging infrastructure that Ababil of Minab chose not to publicize.

“The victims include an Israeli organization in the media sector, an Israeli higher education institution, a Turkish insurance brokerage, and several additional websites across the restaurant, culture, digital services, and news sectors.” states the report.

Against these targets, Gambit found evidence of data exfiltration but not destruction — suggesting the group was selectively publicizing the most dramatic attacks while quietly looting others.

The exfiltration tooling is worth noting. The attackers built a custom Flask-based receiver in Python to collect stolen data in encrypted chunks, with endpoints for starting sessions, resuming interrupted transfers, and validating chunk hashes. The encryption used AES-CBC, but the key and IV were sent in the same POST request as the encrypted data, which means it protected nothing against anyone monitoring the traffic. They also deployed a bespoke C++ tool internally named FileFiend that could enumerate local drives and SMB shares and send files to a hardcoded server. A developer source path leaked in the binary strings: C:\Users\casio\Desktop\uploader v3. Someone named casio built this on their desktop.

The hacktivist branding was cover. The infrastructure, the tooling, the targeting pattern, and the prior activity all point to a state intelligence operation that put on a persona to create ambiguity and complicate attribution. It worked for a few weeks. It didn’t hold up to a serious look.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon