Iranian Government Hackers Attributed to MOIS Behind Los Angeles Transit System Breach

Gambit Security, a Tel Aviv-based firm, published a report Tuesday attributing the March LACMTA breach to Black Shadow, an Iran-MOIS cluster previously identified by Israel's National Cyber Directorate, dismissing Ababil of Minab's hacktivist persona as a front 12. Gambit said it discovered roughly 700 gigabytes of stolen emails, backups, and files on an inadvertently exposed server, then traced configuration fingerprints back to previously identified Iranian infrastructure 34. Attackers who first accessed LACMTA systems around March 16 reached what the group claimed was a rail yard train-control display at Division 11, deleted virtual machines and storage volumes, and targeted backup infrastructure in what Gambit characterized as a deliberate recovery-denial strategy 14. Gambit assessed the campaign as broader than LACMTA, with exfiltration hitting organizations across the United States, Israel, Saudi Arabia, and Turkey, and destructive operations at a subset of victims including a named Israeli media company, an Israeli university, and a Turkish insurance firm 23.