Iranian hackers blamed for breach of Los Angeles transit system that took weeks to recover

A significant security breach affecting the Los Angeles transit system (LACMTA) in March has been attributed to hackers backed by the Iranian government. A report released by the Israeli cybersecurity firm Gambit Security on Tuesday identified the perpetrators as operatives of Iran's Ministry of Intelligence and State Security (MOIS). The hacktivist group, known as Ababil of Minab, claimed responsibility for the incident, asserting they had both stolen and subsequently deleted data from the transit system's infrastructure. The name of the group references a tragic U.S. airstrike on an Iranian school in Minab that resulted in the deaths of over 175 individuals, predominantly children. Gambit Security has expressed skepticism about Ababil of Minab's claims of being an independent hacktivist group, suggesting they are more closely aligned with Iranian state-sponsored groups. Their analysis is supported by forensic evidence linking this group to previous Iranian cyber activities, as well as insights from the Israel National Cyber Directorate regarding MOIS-related actions. The investigation by Gambit also uncovered connections between this group and other cyberattacks targeting entities in Israel, Saudi Arabia, and Turkey. If validated, this would position Ababil of Minab as part of a broader trend of Iranian-backed hacktivist groups masquerading as independent actors. Notably, another group, Handala, recently gained attention for a cyber assault on the U.S. medical technology firm Stryker, leading to significant disruptions. Following that incident, the FBI took action by seizing two Handala websites and the U.S. Justice Department implicated the Iranian government in orchestrating these cyber threats. The backdrop of increased Iranian cyber activity aligns with heightened geopolitical tensions, particularly following U.S. and Israeli military actions against Iran earlier this year. In April, U.S. agencies issued warnings regarding Iranian hackers targeting critical infrastructure across America.