US Re-Indicts Iranian Mabna Institute for Massive Academic and Corporate Cybertheft
Federal authorities have unsealed a superseding indictment against 17 Iranians linked to the Mabna Institute, expanding on a 2018 case and alleging a vast, state-sponsored campaign of cybertheft targeting universities, government agencies, and corporations worldwide.
Federal authorities have re-ignited a significant cybertheft case, unsealing a superseding indictment against 17 Iranians affiliated with the Mabna Institute. The indictment alleges a sprawling, state-sponsored campaign of cybertheft conducted on behalf of the Iranian government, targeting academic institutions, government agencies, and private companies globally. This action expands upon and replaces a 2018 indictment that initially charged nine defendants.
"Today's charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions," stated U.S. Attorney Jamie McDonald for the Southern District of New York. "More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad."
The Mabna Institute, founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, allegedly operated as a front for hackers-for-hire, aiming to illicitly acquire foreign scientific research and intellectual property for Iranian universities and research organizations. The indictment details a massive scale of compromise, with the institute allegedly compromising over 100,000 professor email accounts worldwide. Of these, approximately 8,000 accounts were compromised at 144 U.S. universities, alongside 178 universities in other countries.
Through these compromised accounts, the hackers allegedly stole a staggering 31.5 terabytes of academic journals, dissertations, and e-books across all fields of research. The indictment further suggests that the stolen data was sometimes sold. A press release from the Justice Department highlighted the significant economic impact, stating that U.S.-based universities spent more than approximately $3.4 billion to procure and access such data and intellectual property.
The scope of the alleged cybertheft extended beyond academia. The indictment also details compromises and theft from email accounts belonging to at least five U.S. federal and state government agencies, 42 U.S. companies, and 11 foreign companies. Notably, the media company HBO is listed among the corporate victims.
In total, the 17 defendants face 14 separate charges, some of which overlap. The potential sentences for each offense range from two to 20 years imprisonment. In a coordinated effort, the U.S. State Department's Rewards for Justice program is offering up to $10 million for information leading to the location of four of the indicted individuals.
The re-indictment comes at a time of heightened geopolitical tension, with the U.S. currently engaged in a conflict involving Iran, and diplomatic negotiations showing no signs of progress. "Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength," McDonald emphasized, underscoring the strategic importance of cybersecurity in international relations.
This case underscores the persistent threat posed by state-sponsored cyberespionage campaigns, particularly those targeting intellectual property and academic research. The prolonged nature of the investigation and the expansion of charges highlight the challenges in prosecuting actors operating from abroad and the U.S. government's commitment to pursuing such threats.
The US Department of Justice has announced a superseding indictment against 17 individuals associated with Iran's Mabna Institute, expanding on previous charges. This updated indictment details a vast, state-sponsored cybertheft campaign that targeted hundreds of universities, government agencies, and private companies globally, resulting in the theft of over 31 terabytes of academic data and intellectual property. Furthermore, the US government is now offering rewards of up to $10 million for information leading to the arrest of five key individuals involved in these intrusions.
The U.S. Justice Department has unsealed a superseding indictment against 17 individuals linked to the Iranian Mabna Institute, expanding on a 2018 case. This latest indictment alleges a vast, state-sponsored campaign of cybertheft that began around 2013 and targeted universities, government agencies, and corporations worldwide, stealing at least 31 terabytes of information and intellectual property. The State Department has also offered a $10 million reward for information on five key individuals accused of conducting these cyber intrusions on behalf of the Islamic Revolutionary Guard Corps (IRGC).
The U.S. Department of Justice has announced charges against an additional eight individuals linked to Iran's Mabna Institute, expanding on a 2018 indictment. This superseding indictment details a sophisticated, years-long campaign that allegedly pilfered over 31 terabytes of academic data, intellectual property, and sensitive information from numerous universities, corporations, and government agencies globally. The charges highlight the ongoing efforts by U.S. authorities to pursue actors involved in state-sponsored cyber-espionage and intellectual property theft.
The U.S. Treasury has expanded its actions against the Mabna Institute by sanctioning five individuals linked to the group as part of "Operation Economic Outcast." These sanctions target individuals accused of conducting cyber-attacks on behalf of the Iranian government, aiming to disrupt the group's operations and impose consequences for their malicious cyber activities. The Treasury also designated 30 cryptocurrency addresses linked to four of the indicted defendants, with blockchain analytics firm TRM Labs identifying approximately $16.8 million in these addresses since 2018.