The U.S. Treasury Department announced new sanctions against four Iranians on Monday, August 24, 2026, alleging their involvement in cyberattacks against critical infrastructure and cybertheft targeting the United States. This action follows a recent indictment unsealed by the Justice Department against individuals reportedly affiliated with the Tehran-based Mabna Institute.
Treasury Secretary Scott Bessent described the new measures as an "economic D-Day" against Iran, aiming to sever the regime's global financial connections. The sanctions expand categories of Iran-related conduct that could face secondary sanctions, making it easier to target those who facilitate the regime. Determinations were issued against five key sectors: digital assets, technology, gold, aviation, and shipping, which are reportedly used by the Iranian regime to support its economy.
The individuals designated for sanctions are Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, Mohammad Reza Kadkhoda i, and Mojtaba Ghal eh-Kuhi. The Treasury Department stated that since at least late 2023, Fayyaz Ghareh Blagh, Shahbazi Balujeh, and Kadkhoda i have successfully compromised and exfiltrated data from multiple U.S. companies. These targets included entities in critical infrastructure sectors such as energy, defense contracting, healthcare, information technology, and financial institutions.
Mojtaba Ghal eh-Kuhi is identified as one of the leaders of the group allegedly conducting attacks directed by Iran's Ministry of Intelligence and Security (MOIS). Another individual previously sanctioned in connection with the Mabna Institute in 2018, Behzad Mesri, is also listed as a leader. Additionally, Arman Kahzadian was designated for his alleged role in receiving or using stolen business information obtained through cyber means.
The Treasury Department indicated that while some attacks are MOIS-directed, members of the group are also motivated by personal enrichment, sometimes prioritizing their own profits over state-sponsored operations. This has reportedly led some members to target Iranian companies as well.
The sanctions come nearly five months into a war between the United States and Israel against Iran, which began in February. The U.S. government has previously attributed attacks on U.S. water facilities to Iranian hackers, though former President Donald Trump has denied Iranian culpability in some instances. The Treasury Department did not immediately confirm whether the newly sanctioned individuals were involved in those specific water facility attacks.
