US Re-Indicts Iranian Mabna Institute for Massive Academic and Corporate Cybertheft
Federal authorities have unsealed a superseding indictment against 17 Iranians linked to the Mabna Institute, expanding on a 2018 case and alleging a vast, state-sponsored campaign of cybertheft targeting universities, government agencies, and corporations worldwide.
Federal authorities have re-ignited a significant cybertheft case, unsealing a superseding indictment against 17 Iranians affiliated with the Mabna Institute. The indictment alleges a sprawling, state-sponsored campaign of cybertheft conducted on behalf of the Iranian government, targeting academic institutions, government agencies, and private companies globally. This action expands upon and replaces a 2018 indictment that initially charged nine defendants.
"Today's charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions," stated U.S. Attorney Jamie McDonald for the Southern District of New York. "More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad."
The Mabna Institute, founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, allegedly operated as a front for hackers-for-hire, aiming to illicitly acquire foreign scientific research and intellectual property for Iranian universities and research organizations. The indictment details a massive scale of compromise, with the institute allegedly compromising over 100,000 professor email accounts worldwide. Of these, approximately 8,000 accounts were compromised at 144 U.S. universities, alongside 178 universities in other countries.
Through these compromised accounts, the hackers allegedly stole a staggering 31.5 terabytes of academic journals, dissertations, and e-books across all fields of research. The indictment further suggests that the stolen data was sometimes sold. A press release from the Justice Department highlighted the significant economic impact, stating that U.S.-based universities spent more than approximately $3.4 billion to procure and access such data and intellectual property.
The scope of the alleged cybertheft extended beyond academia. The indictment also details compromises and theft from email accounts belonging to at least five U.S. federal and state government agencies, 42 U.S. companies, and 11 foreign companies. Notably, the media company HBO is listed among the corporate victims.
In total, the 17 defendants face 14 separate charges, some of which overlap. The potential sentences for each offense range from two to 20 years imprisonment. In a coordinated effort, the U.S. State Department's Rewards for Justice program is offering up to $10 million for information leading to the location of four of the indicted individuals.
The re-indictment comes at a time of heightened geopolitical tension, with the U.S. currently engaged in a conflict involving Iran, and diplomatic negotiations showing no signs of progress. "Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength," McDonald emphasized, underscoring the strategic importance of cybersecurity in international relations.
This case underscores the persistent threat posed by state-sponsored cyberespionage campaigns, particularly those targeting intellectual property and academic research. The prolonged nature of the investigation and the expansion of charges highlight the challenges in prosecuting actors operating from abroad and the U.S. government's commitment to pursuing such threats.