Gambit Says Speed of AI-Powered Cyberattacks Drives Need for Cyber Resilience

Recent cyberattacks conducted by a persona linked to Iran demonstrate the speed with which artificial intelligence-enhanced attacks can be carried out, according to cyber resilience platform supplier Gambit.

The attacks by the persona calling itself Ababil of Minab swiftly moved from initial access to the recovery layer, virtualization, backups and storage volumes to maximize destruction and deny remediation, Gambit Cyber Threat Researcher Nir Varon wrote in a Monday (May 26) blog post.

“As AI capabilities become widely available, any actor, skilled or not, will be able to execute this kind of campaign,” Varon wrote. “The question every operator now needs to be asking isn’t only ‘can we keep them out,’ it’s ‘when they get in, can we bring it back.’”

Abadil of Minab claimed to have compromised the Los Angeles County Metropolitan Transportation Authority (LA Metro), destroyed systems and exfiltrated data, according to the post.

The Los Angeles Times reported in April that LA Metro shut down parts of its network in March after detecting unauthorized activity and that the organization was reviewing about 1,400 servers to ensure they were secure before bringing the system back online.

The attack on LA Metro was part of an intrusion campaign that surfaced publicly in late March and targeted organizations in the United States, Israel, Saudi Arabia and Turkey, according to the Gambit blog post.

The attackers deleted virtual machines, databases and storage volumes, per the post.

For operators of IT systems, readiness in the face of attacks like these requires a focus on recoverability and operational resilience, the post said.

“Prevention alone is no longer sufficient,” Varon wrote in the post. “Whether the work is rebuilding compromised systems or making sure destroyed systems and data can truly be restored, proactive resilience management has to be a top priority for every security team.”

PYMNTS reported in March that the Middle East conflict raises cyber risk for businesses. The report said cyberattacks are increasingly likely in times of heightened geopolitical confrontation.

In June 2025, after the U.S. bombing of sites associated with Iran’s nuclear program, four U.S. federal agencies said that fraudsters linked to Iran may launch cyberattacks on organizations in the United States, especially those involved with critical infrastructure.