Adversary Intelligence — 2026-06-03

Gambit Security Attributes Ababil of Minab Destructive Wiper Campaign to Iranian MOIS With Undisclosed Victims in Israel, Saudi Arabia, and Turkey

BLUFAbabil of Minab's simultaneous targeting across Israel, Saudi Arabia, Turkey, and the US signals Iranian MOIS is likely expanding destructive cyber operations beyond bilateral adversaries into a multi-theater coercive tool.

Gambit Security attributed Ababil of Minab to Black Shadow, which the Israel National Cyber Directorate links to Iran's MOIS, via shared staging infrastructure previously used against Israeli military targets in August 2025 1. Named US victims include LA Metro (breach confirmed April 2), the South Florida Regional Transportation Authority, UNIMAC, and GPS tracking service Vyncs; Gambit identified additional undisclosed targets in Israel, Saudi Arabia, and Turkey 12. The campaign combined scripted automation with hands-on-keyboard access to destroy virtual machines, drop database instances, and wipe backup copies; at Vyncs, a Python script dropped all 58 SQL Server targets while the operator manually deleted daily backup files 1. Gambit also recovered two custom exfiltration tools, including a C++ utility called FileFiend that staged stolen files to a hardcoded command-and-control server 1.

Analysis
Layering VM deletion, database drops, and backup wipes in a single operation targets recovery capacity rather than data exfiltration, forcing full rebuilds with no salvageable state. Undisclosed Saudi Arabia victims extend the campaign beyond the bilateral Israel-Iran frame into a multi-theater Iranian coercive posture. A joint CISA, FBI, or NSA advisory is likely within six months of Gambit's May 26 disclosure, which would trigger binding directives and sanctions review authority. Without one, transportation operators have no standing to invoke federal response mechanisms. The staging server connection is consistent with criminal infrastructure brokers reselling MOIS-adjacent capacity, leaving the Ababil of Minab persona authentic rather than a confirmed state front. Confidence is low: attribution rests on a single commercial report with no corroborating government or signals-intelligence sourcing.

3 sources

Iran-Linked Hackers Destroy IT, Backups, and Recovery Systems in Cyberattack targeting Middle East - Cyber Security News
Iran-Linked Hackers Wipe IT Systems and Backups in Middle East Cyberattack - Cyber Press
Attacking the recovery layer: an Iran-MOIS case study - Gambit Security