The Iranian threat actor group Ababil of Minab operated a staging server that was left publicly accessible, resulting in the exposure of over 5 GB of data. This data included SQL backups and SCADA configurations from multiple victims, notably LA Metro, whose breach was confirmed in April. The leak also revealed internal attacker tooling and victim identifiers, providing insight into the campaign and victims beyond what was previously publicly disclosed. The exposure was discovered by Hunt.io researchers and reported via Reddit and their blog. This incident underscores a failure in the attacker’s operational security, inadvertently revealing details about their victims and methods.

Sensitive data from multiple victims, including LA Metro, was exposed publicly due to the attacker’s misconfiguration. This includes over a gigabyte of SQL backups and SCADA configuration files, which could contain critical infrastructure information. The leak also revealed attacker internal tooling and victim names, potentially aiding defenders in attribution and response. While the breach itself was previously confirmed by LA Metro, the server exposure expanded public knowledge of additional victims and attacker infrastructure. There is no indication that this exposure was exploited by other threat actors, but the disclosure increases risk to the affected organizations.

No patch or remediation is applicable as this is a breach resulting from attacker operational security failures. Defenders should use the exposed data to enhance detection and response capabilities against Ababil of Minab. Organizations potentially affected should review their own security posture and monitor for indicators related to this group. Since the exposed server was attacker-controlled, no direct remediation by victim organizations is possible for this specific incident.