US Charges 17 Iranians in Long-Running Cyber Espionage Campaign
Iranian hackers stole 31TB of data from universities and companies worldwide.
1A Large-Scale Cyber Espionage Operation
The US Department of Justice has charged 17 members of Iran-based Mabna Institute for a cyber espionage campaign ongoing since 2013. The group, acting on behalf of Iran's Islamic Revolutionary Guard Corps and other state entities, targeted 144 US and 178 foreign universities, as well as 42 private companies and 5 government agencies. A total of 31TB of academic data and intellectual property was stolen, including employee emails.
2Targeted Academic Institutions and Companies
The hackers targeted over 100,000 professor accounts worldwide, compromising around 8,000 in 24 countries. Using stolen credentials, they accessed research papers, theses, and academic journals, which were later sold on websites like Megapaper.ir and Gigapaper.ir. Customers could purchase academic resources or use compromised accounts to access university libraries.
3A State-Sponsored Operation
According to the charges, Mabna Institute's activities were backed by the Iranian government. The group worked for the Islamic Revolutionary Guard Corps and other state agencies tasked with intelligence gathering. Nine of the 17 defendants were previously charged in a 2018 case. The new charges further clarify the operation's scope and state connections.
4Connection to the HBO Hack
Behzad Mesri, named in the new charges, was previously accused of hacking HBO's systems, stealing proprietary data, and demanding $6 million in Bitcoin. This case links Mesri and four co-defendants to the same intrusion as part of the broader Mabna Institute operation, tying a high-profile entertainment hack to a larger state-linked espionage campaign.
5Financial Damage and Cleanup Costs
The hackers' activities caused significant financial damage beyond stolen research. Password spray attacks forced victims to spend over $20 million investigating and cleaning up breaches. This highlights that the operation had not only data theft but also substantial financial consequences.
6New Defendants and Bounties
Rewards of up to $10 million are offered for information leading to the location of new defendants like Behzad Mesri, Galekuhi, Kahzadian, Fayaz, and Ballojeh. The State Department's Rewards for Justice program uses a Tor-based tip line for submissions. However, most defendants are believed to be in Iran and unlikely to face US courts soon.
7US Message: No Expiration Date
US officials emphasized their determination to expand the case despite an eight-year gap since initial charges. Southern District of New York Attorney Jamie McDonald stated, 'The passage of time will not deter us from pursuing those who target the US.' This underscores how cyber operations are critical to national security and economic interests.
8A New Era in Cybersecurity
This case reflects the growing threat of state-sponsored cyber espionage and the US strategy to counter it. Cyber attacks have become a central tool of national power. The US aims to strengthen its defense and retaliation capabilities to protect institutions and hold attackers accountable. Such operations are expected to continue.