The U.S. Justice Department has unsealed a 14-count indictment against 17 individuals, accusing them of participating in a wide-ranging hacking campaign on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC). The campaign, which allegedly began around 2013, targeted numerous U.S. and international entities, including government agencies, universities, and private companies.
Prosecutors allege that the hackers operated through an Iranian company identified as the Mabna Institute. Eight of the individuals named in the current indictment had previously been charged in 2018 for their involvement in a separate hacking operation. The State Department has offered a reward of up to $10 million for information leading to the apprehension of five individuals—Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh—who are accused of being employed by or affiliated with the Mabna Institute to conduct cyber intrusions.
The indictment details breaches of employee email accounts at several U.S. government entities, including the Department of Labor and the Federal Energy Regulatory Commission. State government agencies in Hawaii and Indiana were also reportedly affected. Internationally, the campaign targeted multiple United Nations organizations, specifically mentioning the U.N. Children’s Fund. The U.N. has not publicly commented on these allegations.
Beyond government targets, the group is accused of compromising 144 U.S.-based universities and 42 U.S. companies, alongside 178 foreign universities and at least 11 foreign companies. The university attacks allegedly involved successfully compromising approximately 8,000 email accounts belonging to professors between 2013 and 2017. The hackers reportedly used stolen credentials to gain access to these accounts.
The stolen data, which prosecutors estimate to be at least 31 terabytes, included academic journals, theses, dissertations, and electronic books across dozens of fields. This intellectual property was allegedly provided to the Iranian government and also sold through two websites to universities within Iran. One of these websites reportedly allowed Iranian customers to use stolen professor accounts to access the online library systems of various U.S. universities. Universities impacted by these breaches are estimated to have spent around $20 million on investigation and remediation efforts.
One of the indicted individuals, Behzad Mesri, was previously charged for an attack on the media company HBO, from which he allegedly attempted to extort $6 million.
Assistant Attorney General John Eisenberg stated that the defendants, at the behest of entities including the IRGC, hacked into universities and research institutions worldwide, stealing intellectual property of "untold value." FBI Assistant Director Brett Leatherman described the operation as a "sprawling hacking-for-hire operation" that targeted intellectual property for the benefit of the Iranian government.
