U.S. prosecutors have charged 17 alleged members of the Iran-based Mabna Institute for participating in a years-long global cyber campaign. According to the Justice Department, the defendants carried out hacks on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC) and other Iranian government and university clients.
The targets included hundreds of universities, companies, and government agencies worldwide. Prosecutors stated that six of the defendants were involved in the 2017 breach of entertainment giant HBO, which included an attempt to extort the company for roughly $6 million in Bitcoin. Behzad Mesri had been previously charged in connection with the HBO hack, while five other defendants—Saeid Houshyar, Manouchehr Hashemloo, Keyvan Fayaz, Saber Shahbazi Ballojeh, and Arman Kahzadian—were newly implicated in that breach.
According to the Department of Justice, the Mabna Institute targeted more than 100,000 professor accounts globally and compromised approximately 8,000 accounts across 144 U.S. universities and 178 foreign universities. The group allegedly used spearphishing and stolen credentials to steal at least 31.5 terabytes of data, including intellectual property, research, academic journals, theses, dissertations, and ebooks.
Assistant Attorney General for National Security John A. Eisenberg said the defendants hacked research institutions at the behest of entities including the IRGC. FBI Cyber Division Assistant Director Brett Leatherman described the operation as a sprawling hacking-for-hire network that targeted American and allied institutions for the benefit of the Iranian government.
The charges arrive amid broader U.S. efforts to disrupt crypto networks utilized by Iran and the IRGC to move funds and evade sanctions. The U.S. Treasury recently sanctioned multiple Iranian crypto exchanges and froze over $131 million across crypto wallets linked to Iran's central bank and armed forces. Meanwhile, the U.S. State Department is offering rewards of up to $10 million for information leading to the location of five of the indicted defendants.
