The U.S. Justice Department has unsealed a superseding indictment charging 17 Iranian nationals in connection with a years-long cyber espionage campaign. The operation, attributed to the Iran-based Mabna Institute, is alleged to have stolen over 31 terabytes of academic data and intellectual property from universities, companies, and government agencies worldwide since at least 2013.
The indictment, announced on August 20, 2026, adds eight new names to an initial seven-count indictment first made public in March 2018. The Mabna Institute is accused of conducting these intrusions on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC) as well as other Iranian government and university clients.
According to the Justice Department, the group compromised systems at 144 U.S. universities and 178 foreign universities. Additionally, at least 42 U.S. private companies, 11 foreign companies, five federal and state government agencies, and two non-governmental organizations were targeted. The stolen data includes entire employee email inboxes from private sector companies, government agencies, and NGOs, in addition to academic materials.
The hackers reportedly targeted more than 100,000 professor accounts globally, successfully breaching approximately 8,000 of them across 24 countries. Stolen credentials were used to access research papers, theses, dissertations, and academic journals, which were then allegedly sold online through websites like Megapaper.ir and Gigapaper.ir. Customers could also use compromised professor accounts to access university libraries, turning the stolen academic resources into a profitable venture.
One of the newly charged defendants, Behzad Mesri, was previously indicted for breaking into HBO's systems, stealing proprietary data, and attempting to extort the company for approximately $6 million in Bitcoin. This superseding indictment connects Mesri and four co-defendants to that HBO intrusion, framing it as part of the broader Mabna Institute operation and linking a high-profile entertainment industry hack to a state-sponsored espionage campaign.
Beyond the theft of research, the indictment claims other defendants conducted password spray attacks against private companies and at least two government entities. These attacks are estimated to have caused victims to incur more than $20 million in costs for investigation and remediation.
U.S. Attorney Jamie McDonald for the Southern District of New York stated that the charges reveal a broader network behind a sweeping, state-sponsored campaign to steal intellectual property. McDonald emphasized that the passage of time would not deter the pursuit of those who target the United States from abroad, highlighting cyber operations as a central instrument of national power.
The State Department's Rewards for Justice program is offering up to $10 million for information leading to the location of five of the newly charged defendants: Mesri, Galekuhi, Kahzadian, Fayaz, and Ballojeh. Tips can be submitted via a Tor-based tip line. While an indictment is not a conviction and all defendants are presumed innocent, the FBI's framing of the case suggests a clear message: open cases, even those spanning eight years, do not have an expiration date, regardless of whether defendants are on U.S. soil.
