DOJ Charges 17 Iranian Nationals in Major Cyber Espionage Campaign

The U.S. Department of Justice has unsealed a 14-count superseding indictment charging 17 Iranian nationals affiliated with the Tehran-based Mabna Institute for executing a long-running, state-sponsored cyber espionage and data-theft campaign. Operating on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC) and other clients since at least 2013, the group allegedly compromised thousands of academic, corporate, and government email accounts, stealing at least 31.5 terabytes of research data and intellectual property worldwide.

// Background

The Mabna Institute was established in Tehran to help Iranian research organizations obtain scientific information from foreign institutions. Threat researchers have tracked the group for years under aliases such as Silent Librarian, Cobalt Dickens, and TA407. In 2017, one of the named defendants, Behzad Mesri, was separately charged for attempting to extort $6 million in bitcoin from HBO following a hack of unaired television content. The current charges follow a initial 2018 indictment and occur alongside heightened cyber threats targeting U.S. critical infrastructure.

// Key Developments

• The 14-count superseding indictment adds eight new defendants to a 2018 case that originally charged nine individuals.
• Hackers breached systems at 144 U.S. universities, 178 foreign universities, 42 U.S. companies, 11 foreign companies, and at least five U.S. federal and state agencies.
• Over 100,000 professors' accounts were targeted globally, resulting in approximately 8,000 compromised accounts and 31.5 terabytes of stolen data.
• Victims include the U.S. Department of Labor, Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations, UNICEF, and HBO.
• The U.S. State Department offered a reward of up to $10 million for information leading to the location of five key defendants.