Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server

**Executive summary:** Hunt.io discovered and captured an exposed operator staging server used by the pro‑Iranian threat actor 'Ababil of Minab', containing ~5 GB of exfiltrated data across 2,238 files and 545 directories that confirm destructive intrusions and data theft from multiple victims (including a confirmed LA Metro breach); the report details custom upload tooling (http.flask.py), the FileFiend uploader (Exchangedb.exe), operator workflow artifacts (.bash_history), IoCs (IPs, domains, SHA‑256 hashes), MITRE ATT&CK mappings, and prioritized mitigation actions.