Israeli researchers link Iran government to LA Metro cyberattack

A cyberattack that crippled a transit system in Los Angeles in March appears to have been carried out not by a pro-Iran hacker group, but by a government ministry, according to new research.

Gambit, an Israeli security company, said in an analysis released this week that new forensic evidence suggests that the Iran Ministry of Intelligence and Security was responsible for the attack on the Los Angeles County Metropolitan Transportation Authority, known as LA Metro. The attack forced the transit agency to shut down access to some of its network after its security team found unauthorized activity, although it said bus and rail service was unaffected.

Gambit’s analysis found that the group responsible is not a new, standalone hacktivist group, but is instead the group Black Shadow, which has links to Iran’s Ministry of Intelligence and Security. Initially, a new pro-Iranian hacking group called Ababil of Minab had claimed responsibility for the attack and published claims on Telegram that they said showed them accessing LA Metro’s internal systems. Gambit said those claims were false.

According to the research, hackers infiltrated a virtual machine on LA Metro’s network and deleted it, as well as its underlying files. Hours later, LA Metro said a “technical issue” was delaying service alerts and preventing riders from loading fares onto their mobile app. Hackers then continued to infiltrate virtual systems and delete files.

The analysis found that the group had also hit organizations in Israel, Saudi Arabia and Turkey, as well as the South Florida Regional Transportation Authority, where the group took databases offline and deleted them. The hackers also appear to have used ChatGPT to improve their scripts and make their hacks more effective, Gambit said.

“What makes this campaign matter beyond the attribution is the velocity,” Gambit researchers wrote. “Modern intrusion operators are moving from initial access straight into the recovery layer, virtualization, backups, storage volumes, to maximize destruction and deny remediation. The skill required to do that at scale is collapsing in parallel. As AI capabilities become widely available, any actor, skilled or not, will be able to execute this kind of campaign.”

Experts have long warned of the threat Iran could pose to U.S. critical infrastructure as it looks to retaliate for the ongoing war in their country and the surrounding region. Other observers said hacking efforts like the ones made against LA Metro and SFRTA should have officials worried, especially if they are backed by Iranian government agencies.

TJ Sayers, senior director of threat intelligence at the Multi-State Information Sharing and Analysis Center, drew a comparison to Handala Hack Team, which emerged in 2023 as a pro-Palestinian hacktivist group judged to be responsible for several cyberattacks during the ongoing war in Iran and is also allegedly operated by Iran’s Ministry of Intelligence and Security.

“Aside from their claimed allegiance with Iranian state causes, very little information was available on Ababil of Minab at the time they claimed the attack,” Sayers continued in an email. “This is not uncharacteristic for emerging Iranian hacktivist collectives, especially with reference to any ties directly to state or state sanctioned activities.”

The ministry was sanctioned in 2022 for what then-Secretary of State Antony Blinken and the U.S. Department of the Treasury’s Office of Foreign Assets Control described as “malign cyber activities,” which included cyberattacks against critical infrastructure. Israel’s top cyberdefense official recently warned that Iran’s hackers are coordinating with each other more closely, too.

Experts said the hacks in Los Angeles and elsewhere represent something of an escalation in Iran’s efforts to wreak havoc in cyberspace. Ensar Seker, chief information security officer at threat intelligence platform SOCRadar, said it shows the nation’s “growing willingness to combine espionage, disruption, and psychological impact in a single campaign.”

“Transportation systems are particularly attractive targets because even limited operational disruption can generate immediate public visibility, media attention, and pressure on local governments,” Seker continued in an email. “In this case, the theft of hundreds of gigabytes of internal data alongside network disruption suggests the attackers were not simply conducting intelligence collection, but also positioning themselves for coercive influence and operational impact.”

Seker warned that organizations that are being targeted need to be hyper-vigilant, especially as it shows that regional conflicts can “increasingly spill” into civilian digital infrastructure that is often far away from the immediate conflict zone.

“Organizations should also pay attention to the data exposure aspect of this incident,” Seker said. “The theft of backups, emails, and internal documentation can create long-term downstream risks including follow-on phishing campaigns, extortion attempts, infrastructure mapping, and targeting of employees or contractors. Many organizations still treat operational disruption and data theft as separate problems, but modern state-aligned actors increasingly combine both into multi-stage campaigns.”