Iran-Linked Hackers Wipe Middle East Orgs’ IT, Backups, and Recovery Systems

Key Takeaways

• An Iran-linked threat actor, operating under the “Ababil of Minab” persona, has launched a destructive cyber campaign targeting organizations in the U.S., Middle East, and Turkey.
• The attacks prioritize data destruction, systematically wiping IT systems, critical backups, and recovery infrastructure, rather than mere data theft.
• Victims include major transportation authorities, a manufacturing company, and a consumer GPS tracking service, with additional targets in media, higher education, and insurance sectors.
• Forensic analysis links “Ababil of Minab” to the notorious Black Shadow group, which is attributed to Iran’s Ministry of Intelligence and Security.

A sophisticated and highly destructive cyber campaign, attributed to an Iran-linked threat actor operating under the guise of “Ababil of Minab,” has systematically targeted and crippled IT systems across multiple organizations in the United States, the Middle East, and Turkey. This operation goes far beyond typical data exfiltration, focusing instead on the complete annihilation of digital infrastructure, including primary systems, backups, and crucial recovery mechanisms.

The campaign, which first emerged in late March and early April 2026, saw “Ababil of Minab” claim responsibility for a breach against the Los Angeles County Metropolitan Transportation Authority (LA Metro). This incident involved the destruction of data, confirmed by LA Metro on April 2, 2026. Following the deletion of virtual machines from the agency’s management console, riders reported issues with the TAP Mobile App, unable to load fare.

Attribution to Iran’s Black Shadow Group

Analysts at Gambit Security have concluded that “Ababil of Minab” is not an independent hacktivist collective, despite its claims. Forensic evidence strongly connects the persona to Black Shadow, a known Iran-linked group. The Israel National Cyber Directorate has previously attributed Black Shadow to Iran’s Ministry of Intelligence and Security, reinforcing the state-sponsored nature of these destructive attacks.

According to a report by Gambit Security, the attackers employed a combination of scripted automation and direct, “hands-on keyboard” techniques to dismantle IT, virtualization, and backup infrastructure. This dual approach allowed for both widespread damage and precise targeting of critical recovery points.

Widespread Impact Across Sectors

Beyond LA Metro, the destructive campaign impacted several other entities. The South Florida Regional Transportation Authority experienced similar attacks, as did the company UNIMAC and the consumer GPS tracking service Vyncs. Investigators also identified victims in Israel and Turkey, spanning the media, higher education, and insurance sectors. The broad scope of these attacks suggests a meticulously planned and coordinated effort, rather than isolated opportunistic incidents.

A defining characteristic of this campaign is the attackers’ methodical approach to eliminating any possibility of recovery. They actively sought out backup systems, executed commands to drop entire database chains, and deleted operating system files to prevent system restoration. In one particularly alarming incident, the threat actor utilized an AI chatbot to refine a custom destruction script, highlighting an evolving sophistication in state-linked cyber operations.

Execution of Destruction

The attackers leveraged two primary methods for their destructive operations: automated scripts and direct manual intervention. At LA Metro, they gained access to the virtualization platform, then powered off and deleted virtual machines. At UNIMAC, they wiped three storage volumes, notably renaming new partitions “Minab” as a defiant signature.

For Vyncs, a custom Python script named main.py was deployed, iterating through 58 SQL Server targets to drop every database. This script achieved a 100% success rate. Concurrently, the attacker manually deleted 16 daily SQL backup files and subsequently destroyed core Windows system folders via Windows Explorer, effectively crashing their own remote session and confirming the complete eradication of data.

The South Florida Regional Transportation Authority was compromised through a proxied remote desktop connection. Once inside, the attackers took databases offline and used a secure deletion tool to overwrite the web hosting directory, including a dedicated SQL backup folder. These actions demonstrate a deep understanding of victim environments and a clear intent to ensure irrecoverable data loss.

Custom Tools and Attribution Details

During their investigation, researchers uncovered two custom tools used for data exfiltration. The first method involved compressing stolen files and uploading them to the victim’s own public website, then retrieving them via an attacker-controlled server. The second was a bespoke C++ tool named FileFiend, designed to scan local drives and network shares before transmitting stolen data to a hardcoded command-and-control server.

The attackers also deployed a Flask-based file receiver to collect uploads from compromised environments. While file transfers were encrypted, the encryption key was transmitted within the same request as the data, rendering it vulnerable to interception. Intriguingly, attempts to access non-existent pages on the attacker’s server would redirect visitors to the FBI’s official website.

The most compelling evidence linking “Ababil of Minab” to Black Shadow emerged from a staging server. This server had previously hosted a fake mental health support website in August 2025, specifically designed to target Israeli soldiers—an operation definitively attributed to Black Shadow. The same server was later observed transferring stolen files into the infrastructure used for the current destructive campaign, solidifying the attribution.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Isolate Backups: Implement robust offline or immutable backup solutions that are physically or logically separated from the primary network to prevent their destruction during an attack.
• Strengthen Access Controls: Enforce multi-factor authentication (MFA) across all critical systems and accounts, particularly for remote access and administrative interfaces. Regularly review and audit access privileges.
• Implement Network Segmentation: Segment networks to limit lateral movement by attackers. Critical infrastructure and sensitive data should reside in highly restricted network zones.
• Enhance Monitoring and Detection: Deploy advanced endpoint detection and response (EDR) and security information and event management (SIEM) solutions to detect unusual activity, especially attempts to delete or modify system files and backups.
• Develop and Test Incident Response Plans: Regularly update and practice incident response and disaster recovery plans, focusing on scenarios involving data destruction and system wiping.
• Regularly Patch and Update: Ensure all operating systems, applications, and firmware are kept up-to-date with the latest security patches to mitigate known vulnerabilities.
• Educate Employees: Conduct ongoing cybersecurity awareness training to help employees recognize and report phishing attempts and other social engineering tactics that could lead to initial compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.