U.S. DOJ Charges 17 Iranians in Extensive Cyber Theft Operation Targeting Universities and Corporations

The U.S. Department of Justice (DOJ) has charged 17 Iranian nationals in connection with a sprawling cyber theft campaign that targeted hundreds of universities, companies, government agencies, and other organizations globally. The campaign, which began no later than 2013, was allegedly orchestrated by the Mabna Institute, an Iran-based hacking-for-hire organization acting on behalf of the Islamic Revolutionary Guard Corps (IRGC).

A superseding indictment unsealed on Tuesday expands a case originally announced in 2018, adding eight new defendants to the nine previously charged. According to the DOJ, the Mabna Institute’s members systematically targeted 144 universities in the United States and 178 universities abroad. In addition, they compromised at least 42 U.S. companies, 11 foreign companies, and five U.S. government agencies.

The hackers focused heavily on academic institutions, targeting over 100,000 professor accounts and successfully compromising approximately 8,000 of them. Using stolen credentials, they accessed university systems to exfiltrate research papers, academic journals, dissertations, and other forms of intellectual property. The DOJ estimates that the total volume of stolen data exceeds 31.5 terabytes.

The stolen academic materials were not only exploited for espionage but also monetized. The indictment alleges that the hackers operated two websites facilitating the sale of compromised university accounts and access to online academic libraries, primarily serving customers within Iran.

Beyond academia, the cybercriminals targeted prominent organizations including the U.S. Department of Labor, the Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations, and UNICEF.

Among the private-sector victims was HBO. Several of the newly charged defendants are accused of involvement in the 2017 HBO breach, where hacker Behzad Mesri allegedly stole proprietary data and attempted to extort the company for approximately $6 million in Bitcoin.

The DOJ highlights that the cyberattacks inflicted more than $20 million in costs related to investigations and remediation efforts.

In a bid to apprehend the suspects, the U.S. State Department has announced rewards of up to $10 million for information leading to the location of five of the defendants.

This case underscores the increasingly sophisticated and organized nature of Iranian cyber operations, which blend state-directed espionage with intellectual property theft and hacking-for-hire activities. The Mabna Institute’s actions reflect a strategic approach to cybercrime that targets valuable research and proprietary data across multiple sectors worldwide.