US Charges 17 Iranians in Extensive Cyber Espionage Operation
The US Department of Justice has unsealed a superseding indictment charging 17 members of the Mabna Institute, an Iran-based hacking group, for their involvement in a long-running cyber espionage campaign. This operation, which has been active since at least 2013, is said to have been conducted on behalf of Iran’s Islamic Revolutionary Guard Corps and various government and university clients.
According to the indictment, the group successfully compromised systems at 144 US universities and 178 foreign institutions, along with at least 42 US private companies, 11 foreign companies, five federal and state government agencies, and two non-governmental organizations. The hackers are alleged to have stolen over 31 terabytes of academic data and intellectual property, including entire employee email inboxes.
The Justice Department's press release highlights that the Mabna Institute's activities included targeting more than 100,000 professor accounts worldwide, successfully breaching around 8,000 of these accounts across approximately 24 countries. The stolen academic materials were reportedly sold online through platforms such as Megapaper.ir and Gigapaper.ir, allowing customers to purchase access to academic resources or use compromised accounts to infiltrate university libraries.
Among the newly indicted individuals is Behzad Mesri, who previously gained notoriety for hacking HBO and attempting to extort the company for $6 million in Bitcoin. This connection underscores the broader implications of the Mabna Institute's operations, linking high-profile entertainment industry breaches to a larger state-sponsored espionage initiative.
The financial repercussions of these cyber intrusions extend beyond the theft of research. The indictment states that the defendants executed password spray attacks against private companies and government entities, leading to over $20 million in costs for victims who had to investigate and remediate the breaches.
U.S. Attorney Jamie McDonald emphasized the significance of these charges, stating that they reveal a comprehensive network behind a state-sponsored campaign aimed at stealing intellectual property from American institutions. He noted that the passage of time does not diminish the commitment to pursue those targeting the United States from abroad, highlighting the importance of cyber operations in national security.
Five of the newly charged defendants now have a bounty attached to their names, with the State Department offering up to $10 million for information leading to their capture. Given that many of these individuals are likely still in Iran, this reward represents a crucial tool for U.S. prosecutors.
While an indictment does not equate to a conviction, the FBI's framing of the case sends a clear message: the pursuit of justice for cyber crimes remains a priority, regardless of the time elapsed since the original charges were filed. This expanded indictment serves as a reminder that the U.S. will continue to address cyber threats and hold accountable those who engage in such activities against American interests.
