The U.S. government has announced charges against 17 alleged members of the Mabna Institute, an Iranian hacking-for-hire entity, for a multi-year campaign of data theft targeting academic institutions, private companies, and government agencies. The new indictment, filed in the Southern District of New York, adds eight individuals to a previous indictment from 2018 that named nine others.
According to the U.S. Department of Justice, the group is accused of stealing over 31 terabytes of academic data and intellectual property. Their targets included 144 U.S. universities and 178 universities in other countries, at least 42 U.S. private companies and 11 foreign ones, at least five U.S. federal and state agencies, and at least two non-governmental organizations. The indictment states that much of this activity was conducted on behalf of Iran's Islamic Revolutionary Guard Corps, the intelligence and security arm of the Iranian government, as well as other Iranian government and university clients.
The campaign reportedly began around 2013 and continued through at least December 2017. It broadly targeted academic data and intellectual property from compromised university systems. The U.S. government estimates that U.S.-based universities spent approximately $3.4 billion to procure and access such data and intellectual property during the conspiracy.
The hackers employed spearphishing techniques, targeting over 100,000 professor email accounts globally and successfully gaining access to approximately 8,000 of them. Once inside these accounts, they allegedly exfiltrated research papers, theses, dissertations, and academic books across various fields, including science, engineering, medicine, and the social sciences.
The operation also involved the resale of stolen materials. Two websites were reportedly used to sell the pilfered data to buyers within Iran, including public universities. One of these sites allowed paying customers to log directly into compromised professor accounts to access U.S. and foreign university library systems.
Beyond higher education, several of the accused are linked to intrusions at other organizations, including the U.S. Department of Labor and the Federal Energy Regulatory Commission. Prosecutors estimate that remediation costs for these incidents exceeded $20 million. HBO was also named as a victim, with one defendant accused of hacking the company, stealing internal data, and attempting to extort approximately $6 million in Bitcoin. Four other individuals in the new indictment are reportedly connected to the HBO intrusion.
U.S. Attorney Jamie McDonald for the Southern District of New York emphasized that the passage of time would not deter authorities from pursuing those who target the United States from abroad. The State Department's Rewards for Justice program is offering a reward of up to $10 million for information leading to the whereabouts of five of the defendants named in the indictment.
If convicted, the individuals face potential sentences of up to 20 years in prison for wire fraud charges alone, in addition to charges for conspiracy, computer fraud, and identity theft. None of the defendants are currently in U.S. custody, and given the diplomatic relationship between Washington and Tehran, arrests are considered unlikely in the near future.
