Iranian intelligence service behind hack of LA transit system, researchers say

Gambit Security attributes a March destructive intrusion against LACMTA to an MOIS-linked group calling itself Ababil of Minab, which exfiltrated data and erased databases, virtual machines, and storage to deny recovery; researchers identified additional victims across Israel, Turkey, Saudi Arabia and multiple commercial sectors and highlighted the group’s use of custom exfiltration tooling and techniques targeting virtualization, backups, and storage.