Adversary Intelligence — 2026-05-30

Iran MOIS-Linked Black Shadow Group Conducted Destructive Cyber Campaign Against US Transportation Infrastructure

BLUFWashington is unlikely to formally attribute these MOIS-linked transit attacks before late August, leaving a destructive playbook targeting backup infrastructure unaddressed by sector-wide directive.

Israeli cyber resilience firm Gambit Security on May 27 linked the "Ababil of Minab" persona to Black Shadow, an Iran-linked group attributed by Israel's National Cyber Directorate to MOIS, characterizing the persona as a fabricated hacktivist front for state operations 12. At LA Metro, an attacker deleted VMs through an authenticated vCenter session on March 16, exfiltrating at least 700 GB of data including emails and backups and accessing a rail-yard management and train control display system; the breach was confirmed publicly on April 2 12. The same campaign struck the South Florida Regional Transportation Authority and Maryland-based connected-vehicle software firm Agnik with destructive database and backup wipes, while Gambit identified additional undisclosed exfiltration victims in Israel, Saudi Arabia, and Turkey 1. Attribution rests on shared C2 infrastructure, with IP 46.30.190.173 hosting a customized Go tunneler also used by Black Shadow, corroborated by ClearSky Cyber Security and researcher Simon Kenin 1.

Analysis
Washington is unlikely to issue a formal attribution advisory by August 30, 2026. The US has historically deferred on Iranian destructive cyber attribution even when private-sector forensics are mature, and that pattern holds here: the intrusions reveal an MOIS targeting doctrine that prioritizes the recovery layer, maximizing outage duration by destroying backup and virtualization infrastructure before reconstitution can begin. Confidence is moderate: attribution rests on a single forensic report corroborated by two independent researchers but lacks signals intelligence confirmation. The shared C2 infrastructure is equally consistent with Iranian threat actor infrastructure pooling rather than direct MOIS command, and Ababil of Minab may operate as an independently tasked contractor with access to Black Shadow tooling rather than a subordinated element. Absent formal attribution, CISA lacks binding directive authority over transit operators and State Department sanctions levers against MOIS remain closed.

3 sources

Gambit links Iran-linked Black Shadow group to destructive cyber campaign targeting US, Middle East organizations - Industrial Cyber
LA Metro Cyberattack Linked to Iranian State-Sponsored Hackers - SecurityWeek
Attacking the recovery layer: an Iran-MOIS case study - Gambit Security