A sophisticated cyber-espionage campaign that hit critical infrastructure and corporate targets across the U.S., Israel, Saudi Arabia, and Turkey under the guise of grassroots hacktivism was actually the work of state-sponsored Iranian actors, according to a new report from threat intelligence firm Gambit Security.
The threat actor, operating under the moniker “Ababil of Minab,” deployed a devastating combination of automated data exfiltration and targeted infrastructure destruction. According to Gambit researchers Eyal Sela and Nir Varon, forensic evidence directly links the campaign to Black Shadow an established hacking collective previously attributed by the Israel National Cyber Directorate (INCD) to Iran’s Ministry of Intelligence and Security (MOIS).
Operating both via scripted automation and highly calculated hands-on-keyboard maneuvers, the attackers systematically dismantled IT, virtualization, database, and backup networks. In a striking technological twist, researchers found evidence that the group used OpenAI’s ChatGPT to refine their destructive code, ensuring it specifically targeted user application databases while filtering out protected system databases to maximize operational efficiency.
The digital assault directly disrupted critical transportation infrastructure in major American metropolitan areas. Public transit operator Los Angeles County Metropolitan Transportation Authority (LA Metro) fell victim to an intrusion on March 16, 2026. Working through an authenticated vCenter session, the hacker unilaterally powered off and deleted critical virtual machines directly from the disk datastore. Hours later, LA Metro was forced to notify commuters via social media that a “technical issue” had crippled its automated service alerts and halted fare loading capabilities on its TAP Mobile App. The attacker subsequently breached a Windows guest machine to wipe core disk partitions.
A similar playbook was executed against the South Florida Regional Transportation Authority (SFRTA). Gambit’s investigation uncovered recorded screencasts showing the threat actor utilizing proxy tools to establish remote desktop access into the Florida transit system’s network. Once inside, the attacker seized local administrator privileges, using SQL Server Management Studio to take enterprise databases offline, sever active client connections, and permanently drop the objects. To stymie recovery efforts, the group deployed WipeFile, a military-grade secure deletion utility, to overwrite hosted web directories and backup repositories.
The offensive extended deep into the Middle East, striking United Maintenance and Contracting Company (UNIMAC) in Saudi Arabia. In that instance, the hacker formatted attached storage volumes, deleted the existing partitions, and aggressively overwrote them with new volumes named “Minab.” The attackers then compromised the company’s Veeam Backup & Replication console, triggering “Delete from disk” commands to permanently erase the organization’s entire historical backup chain. Another target, fleet management provider Vyncs, saw 58 distinct SQL Server targets wiped simultaneously via custom Python scripts.
While Ababil of Minab publicly boasted of its destructive operations against those four high-profile entities, Gambit’s forensic analysis of the hackers’ staging infrastructure revealed a broader, quieter data-harvesting operation. Security teams discovered stolen corporate files belonging to unpublicized victims, including an Israeli media organization, an Israeli higher education institution, a Turkish insurance brokerage, and several digital services firms.
The operational footprints left on the staging infrastructure specifically file transfers originating from known Iranian servers cemented the tie to state-backed operations. Additional data provided by ClearSky Cyber Security and independent researcher Simon Kenin tracked malicious command-and-control IP addresses back to customized Go-based network tunnelers historically exclusive to the Black Shadow toolkit. The findings underscore a growing trend where state actors weaponize administrative tools, commercial AI, and hacktivist cover identities to accelerate destructive campaigns against Western corporate and civilian infrastructure.
