Adversary Intelligence — 2026-05-30

Gambit Links Iran MOIS Black Shadow Group to Destructive Campaign Against US Transit Systems

Gambit Security's May 26 report, drawing on corroborating analysis from ClearSky Cyber Security and researcher Simon Kenin, tied the "Ababil of Minab" persona to Black Shadow, a group the Israel National Cyber Directorate attributed to Iran's MOIS, via shared C2 infrastructure and a customized Go tunneler 1. At LA Metro, attackers using an authenticated vCenter session deleted virtual machines and disk partitions on March 16; the authority confirmed the breach on April 2 and reported hundreds of servers required forensic review 12. At the South Florida Regional Transportation Authority, proxied RDP sessions enabled SQL database deletion and file overwrite using a secure deletion utility 1. Gambit also identified undisclosed victims in Israeli media, higher education, and Turkish insurance, where data exfiltration occurred without destructive follow-on 1.

Analysis
US government formal attribution of the LA Metro and South Florida RTA attacks to an Iranian state actor within 180 days is genuinely uncertain. The evidentiary chain runs through an Israeli private firm, not a confirmed US intelligence hold, and the government's record on timely public naming of MOIS cyber actors is uneven. The deliberate targeting of virtualization and backup layers, not operational data alone, reflects a recovery-denial intent that marks a departure from data-theft-first MOIS tradecraft. The Ababil of Minab persona follows standard MOIS practice, lowering diplomatic cost while complicating public attribution. Moderate confidence rests on corroboration from ClearSky Cyber Security and researcher Simon Kenin, offset by the absence of confirmed US-held primary sourcing.
3 sources
  1. Gambit links Iran-linked Black Shadow group to destructive cyber campaign targeting US, Middle East organizations - Industrial Cyber
  2. LA Metro Cyberattack Linked to Iranian State-Sponsored Hackers - SecurityWeek
  3. Attacking the recovery layer: an Iran-MOIS case study - Gambit Security

View in full brief →

UNCLASSIFIED // OPEN SOURCE