DOJ Unveils Charges Against 17 Iranian Hackers in Massive IRGC-Linked Cyber Espionage Operation

The U.S. Department of Justice (DOJ) has unsealed a 14-count superseding indictment against 17 individuals accused of conducting a prolonged cyber espionage campaign on behalf of Iranian government and university clients, including the Islamic Revolutionary Guard Corps (IRGC). The defendants are alleged members of the Mabna Institute, an Iran-based hacking group.

According to the indictment, the cyber operation began around 2013 and persisted through at least December 2017. Prosecutors state the group targeted a wide range of victims, including universities, private companies, government agencies, and non-governmental organizations across the United States and internationally.

The Mabna Institute was reportedly founded by Gholamreza Rafatnejad and Ehsan Mohammadi with the goal of providing Iranian institutions access to foreign scientific resources. The group employed hackers-for-hire who executed phishing campaigns, reconnaissance, credential theft, password spraying, and data exfiltration.

The indictment details that the hackers targeted more than 100,000 professor email accounts globally, successfully compromising approximately 8,000 academic accounts. Among the victims were 144 universities in the U.S. and 178 institutions abroad, spanning Australia, Canada, China, Europe, the Middle East, Asia, and the United Kingdom.

Using spearphishing emails, the attackers stole login credentials from professors to infiltrate university networks and online library portals. Once inside, they accessed a vast array of protected academic materials, including journals, dissertations, theses, electronic books, research papers, and other intellectual property across scientific, engineering, medical, social science, technology, and professional disciplines.

The stolen data, totaling at least 31.5 terabytes, was exfiltrated to infrastructure controlled by the conspirators outside the United States. Prosecutors noted that U.S. universities had invested over $3.4 billion to obtain access to the targeted research and intellectual property.

In addition to theft, the operation monetized stolen academic access through two Iran-based websites: Megapaper.ir and Gigapaper.ir. Megapaper sold stolen academic content to customers within Iran, while Gigapaper offered direct access to compromised university library systems via hijacked professor accounts.

Beyond academia, the indictment alleges that the Mabna Institute targeted at least 42 U.S. private-sector companies, 11 foreign companies, five U.S. federal and state government agencies, and several international organizations. Named victims include the U.S. Department of Labor, the Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations, and UNICEF.

The superseding indictment adds eight defendants to a case initially announced in 2018. Several defendants are also linked to the 2017 HBO intrusion, where stolen data was used in an attempted extortion scheme demanding approximately $6 million in Bitcoin.

Charges brought against the defendants include conspiracy to commit computer intrusions, wire fraud, unauthorized access for private financial gain, and aggravated identity theft. The DOJ reported that victims incurred over $20 million in investigation and remediation costs related to some of the private-sector and government intrusions.

The U.S. State Department’s Rewards for Justice program is offering up to $10 million for information leading to the location of five defendants: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh. The indictment remains an allegation, and all defendants are presumed innocent until proven guilty in a court of law.