Ababil of Minab

Also known as ION-87, Black Shadow

Reports

First seen

May 26

Last seen

Jun 4

Motivation

espionage, disruptive cyber attacks, geopolitical r, espionage/sabotage

Targeting

Sectors

transportation logistics ×1other ×1

Victim regions

United States ×1

Top ATT&CK techniques

T1566 Phishing ×2T1195 Supply Chain Compromise ×2T1598 Phishing for Information ×2T1567 Exfiltration Over Web Service ×2T1190 Exploit Public-Facing Application ×2T1041 Exfiltration Over C2 Channel ×2T1003 OS Credential Dumping ×2T1598.004 Spearphishing Attachment ×1T1555 Credentials from Password Stores ×1T1021.002 Remote Services: SMB/Windows Admin Shares ×1T1598.003 Spearphishing Link ×1T1078 Valid Accounts ×1

Indicators

filename ×6cve ×4domain ×4ip_v4 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-0257 (exploited)CVE-2026-26980 (exploited)CVE-2026-48131 CVE-2026-48132

Recent reports

High

Threats to the 2026 FIFA World Cup: Physical Security, Cyber, and Influence Operations Risk Assessment

Recorded Future InsiktJun 4 High

Weekly Threat Intelligence Report – June 1st: Data Breaches, AI-Driven Threats, and Active CVE Exploitation

Check Point ResearchJun 1 High

Iranian intelligence service behind LA transit system hack, researchers say

The Record (Recorded Future News)May 27 High

MuddyWater Deploys DLL Side-Loading in Multi-Country Espionage Campaign

The Hacker NewsMay 26

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.