DOJ Indicts 17 Iranian Nationals in Massive 31-Terabyte Global Cyber Espionage and Extortion Campaign

The U.S. Department of Justice has unsealed a 14-count superseding indictment charging 17 Iranian nationals associated with the Tehran-based Mabna Institute for orchestrating a decade-long cybertheft campaign. Operating on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC) and other state entities since 2013, the hackers allegedly stole over 31 terabytes of academic data and intellectual property from 144 U.S. and 178 foreign universities, alongside compromising email accounts at dozens of private companies, government agencies, and non-governmental organizations. The campaign utilized spearphishing and password spray attacks, costing victims over $20 million in remediation. Additionally, six defendants are linked to the 2017 HBO breach and a subsequent $6 million Bitcoin extortion attempt. The U.S. State Department has offered a reward of up to $10 million for information leading to the location of five key fugitives.

// Background

The Mabna Institute was founded in Iran around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi to assist Iranian research organizations in obtaining foreign scientific data. In March 2018, the U.S. government first indicted nine of its members and imposed Treasury sanctions. The newly unsealed 2026 indictment expands the prosecution to 17 defendants, linking the group's activities directly to the IRGC. This legal action occurs amid heightened geopolitical tensions and a wave of recent cyber operations attributed to Iran-aligned groups, including attacks on U.S. water infrastructure and the compromise of federal officials' personal accounts.

// Key Developments

• DOJ unsealed a 14-count superseding indictment charging 17 Iranians affiliated with the Mabna Institute, adding eight new defendants to a case first brought in 2018.
• The hackers allegedly stole 31.5 terabytes of academic data and intellectual property, targeting over 100,000 professor accounts globally and successfully compromising approximately 8,000.
• Victims include 322 universities globally, 53 private companies, and government entities such as the U.S. Department of Labor, FERC, the states of Indiana and Hawaii, the UN, and UNICEF.
• Six defendants are tied to the 2017 HBO hack, which involved the theft of proprietary data and a $6 million Bitcoin extortion attempt.
• The U.S. State Department is offering a bounty of up to $10 million for information on five fugitives: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh.
• Stolen academic credentials and data were commercialized inside Iran via websites Megapaper.ir and Gigapaper.ir.