🇮🇷 An Iranian operator left their staging server wide open, and it named every LA Metro breach victim a public report withheld
Source Reddit Cybersecurity
Discussion
An Iranian threat actor group known as Ababil of Minab left a staging server publicly accessible, exposing over 5 GB of data related to multiple victims including LA Metro. The exposed data includes SQL backups, SCADA configurations, attacker tooling, and victim names. LA Metro confirmed their breach in April, but additional victims were only revealed due to this server exposure. This incident reveals operational security failures by the attacker, leading to unintended disclosure of sensitive information.
r/cybersecurity (opens in a new tab)u/Straight-Practice-990 points0 comments
Ababil of Minab is a pro-Iranian group that claimed destructive intrusions against targets in the US, Israel, Saudi Arabia, and Turkey this year. LA Metro confirmed their breach in April. A later report described the campaign but held back the additional victims.
Hunt.io researchers found the operator's own staging server filling that gap: 5 GB of data, the upload tooling, the bash history, and folders named after each target, including over a gigabyte of LA Metro SQL backups down to SCADA configs.
Read the full story here: https://hunt.io/blog/ababil-of-minab-iranian-hackers-exposed-la-metro-breach-open-directory
Links cited in the discussion
Also discussed in r/blueteamsec, r/threatintel, r/netsec