Security researchers have identified Iranian-backed hackers as the culprits behind a significant breach of the Los Angeles transit system (LACMTA) in March. Israeli startup Gambit Security released a report attributing the attack to Iran’s Ministry of Intelligence and State Security (MOIS).

A hacktivist group known as Ababil of Minab initially took responsibility, referencing an Iranian air strike that killed over 175 people in Minab, mostly children. However, Gambit claims this is a false flag operation, citing forensic evidence linking the group to previous Iran-linked campaigns.

The latest allegations come amid increased Iranian cyber activity following U.S. and Israeli military operations against Iran earlier this year. In April, a coalition of U.S. agencies warned that Iran was targeting American critical infrastructure through its hackers.

This is not the first time Ababil of Minab has claimed credit for attacks; they were also accused of hacking Stryker, an American medical tech company, earlier this year. The FBI seized two Handala websites in connection with the Stryker breach, with the U.S. Justice Department subsequently accusing Iran’s government of orchestrating these operations.

With so many groups and claims at play, it remains unclear whether Ababil of Minab is a standalone hacktivist group or merely a tool in Iran’s cyber arsenal. As Gambit suggests, this could be yet another example of Iran using false flag tactics to sow discord and deflect blame elsewhere.