Gambit Links LA Metro Cyberattack to Iran-Linked Hackers
Summary
LA Metro reported a breach and internal operational disruption, though rail and bus services were unaffected. Gambit linked the group claiming the attack to infrastructure and activity associated with Black Shadow, an Iran-linked group.
Key points
- LA Metro discovered a breach in mid-March that caused internal operational disruptions; rail and bus services were not affected.
- LA Metro said hundreds of servers were checked for signs of compromise before being brought back online.
- Ababil of Minam claimed the attack and alleged it wiped hundreds of terabytes of data and exfiltrated more than 1 TB of files.
- The group published screenshots and videos purporting to show access to LA Metro systems, including virtualization management, web server, and train-monitoring OT systems.
- Gambit said forensic evidence linked the operation to infrastructure and activity associated with Black Shadow, which Israel's cyber directorate attributed to Iran's Ministry of Intelligence and Security.
- Gambit reported identifying Ababil of Minam attacks against organizations in the US, Israel, Saudi Arabia, and Turkey, with data exfiltration observed in those attacks and destructive activity in some cases.
Article Details
- Victim Organization
- Los Angeles County Metropolitan Transportation Authority (LACMTA), known as LA Metro
- Incident Type
- Cyberattack involving a confirmed breach; destructive activity and data exfiltration were claimed by Ababil of Minab.
- Data Types Exposed
- Files; specific contents not disclosed. Exfiltration was claimed by Ababil of Minab.
- Affected Data Size
- Ababil of Minab claimed it exfiltrated more than 1 TB of files and wiped hundreds of terabytes of data; these quantities were not independently confirmed in the article.
- Operational Impact
- Internal operational disruptions occurred. LA Metro said hundreds of servers had to be checked for compromise before being brought back online. Rail and bus services were not impacted.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Threat Actors
Ababil of MinabClaimed responsibility for the LA Metro attack. The group allegedly claimed it wiped hundreds of terabytes of data and exfiltrated more than 1 TB of files; those actions and quantities are not independently confirmed in the article. Gambit reported links between the operation and infrastructure and activity associated with Black Shadow.Black ShadowGambit said forensic evidence tied the LA Metro operation to infrastructure and activity associated with Black Shadow, an Iran-linked group. The Israel National Cyber Directorate attributed Black Shadow to Iran's Ministry of Intelligence and Security.
Products
Countries
IranA few days later, the attack on LA Metro was claimed by Ababil of Minab, which purports to be a pro-Iran hacktivist group.Israeland activity associated with Black Shadow, an Iran-linked group, which was attributed by the Israel National Cyber Directorate to Iran’s Ministry of Intelligence and Security.”Saudi ArabiaGambit identified attacks launched by Ababil of Minab against organizations in the US, Israel, Saudi Arabia, and Turkey.TurkeyGambit identified attacks launched by Ababil of Minab against organizations in the US, Israel, Saudi Arabia, and Turkey.United StatesGambit identified attacks launched by Ababil of Minab against organizations in the US, Israel, Saudi Arabia, and Turkey.
Industries
Cultureinstitution, a Turkish insurance brokerage, and several additional websites across the restaurant, culture, digital services, and news sectors,” Gambit said.Digital servicesa Turkish insurance brokerage, and several additional websites across the restaurant, culture, digital services, and news sectors,” Gambit said.Higher Education“The victims include an Israeli organization in the media sector, an Israeli higher education institution, a Turkish insurance brokerage, and several additional websites across the restaurant, culture, digital services,Insuranceinclude an Israeli organization in the media sector, an Israeli higher education institution, a Turkish insurance brokerage, and several additional websites across the restaurant, culture, digital services, and newsMedia“The victims include an Israeli organization in the media sector, an Israeli higher education institution, a Turkish insurance brokerage, and several additional websites across the restaurant, culture, digital services,Newsinsurance brokerage, and several additional websites across the restaurant, culture, digital services, and news sectors,” Gambit said.Public transportationThe recent disruptive cyberattack that targeted the Los Angeles public transportation system has been linked to the Iranian government.Restauranthigher education institution, a Turkish insurance brokerage, and several additional websites across the restaurant, culture, digital services, and news sectors,” Gambit said.