Iranian Hackers Connected to Ongoing Breach of Los Angeles Transit System
Security specialists have linked a breach of the Los Angeles transit system (Los Angeles County Metropolitan Transportation Authority, or LACMTA) in March to hackers supported by Iran. A report published on Tuesday by the Israeli firm Gambit Security indicates that these hackers have ties to Iran’s Ministry of Intelligence and State Security (MOIS).
Reuters was the first to cover the findings from the Gambit report.
A hacktivist group called Ababil of Minab has claimed responsibility for the initial breach, stating that they stole and then removed data from LACMTA’s systems. The group’s name references a U.S. airstrike in Minab, Iran, which tragically resulted in the deaths of over 175 people, mostly children.
“They are not a new, independent hacktivist group as they claim,” commented Gambit.
Ababil of Minab did not reply to a comment request from TechCrunch.
Gambit suggested that their claims are backed by forensic evidence connecting the group to a previous campaign associated with Iran, as well as activities attributed to the MOIS by the Israel National Cyber Directorate. The firm is also investigating other attacks directed at entities in Israel, Saudi Arabia, and Turkey.
Contact Us
Do you have further information regarding Ababil of Minab or other Iranian-affiliated hackers and their cyber operations? For a secure communication from a non-work device, you can reach Lorenzo Franceschi-Bicchierai on Signal at +1 917 257 1382, or through Telegram and Keybase @lorenzofb, or via email.
If Gambit’s assessment holds true, Ababil of Minab would be the latest in a series of alleged hacktivist groups operating on behalf of the Iranian government. An earlier instance is Handala, which compromised the U.S. medical technology company Stryker earlier this year, affecting thousands of organizational systems and employee devices.
After the Stryker breach, the FBI seized two Handala websites, and the U.S. Justice Department accused Iran’s government of coordinating the hacktivist group’s activities.
In light of recent U.S. and Israeli military actions against Iran earlier this year, Iranian-aligned hackers have intensified their efforts and claimed responsibility for various hacks. In April, a coalition of U.S. agencies warned that Iranian hackers were targeting critical infrastructure in the United States.
