The U.S. Department of Justice has unsealed a 14-count superseding indictment charging 17 Iranian nationals associated with the Tehran-based Mabna Institute. Operating on behalf of Iran's Islamic Revolutionary Guard Corps, the hackers allegedly executed a massive cyber campaign since 2013, compromising 8,000 professor accounts across 322 global universities. The group stole 31.5 terabytes of academic data and intellectual property valued at $3.4 billion. The U.S. State Department has authorized a $10 million reward to locate five of the key defendants.
Mabna Institute hacking campaign
- ▪The Mabna Institute, founded in approximately 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, allegedly carried out cyberattacks against U.S. and international organizations.
- ▪The Mabna Institute targeted more than 100,000 professor accounts worldwide and successfully compromised approximately 8,000 professor email accounts.
- ▪The Mabna Institute targeted the computer systems of 144 U.S. universities, 178 foreign universities, 42 U.S. private companies, 11 foreign companies, five U.S. government agencies, and two nongovernmental organizations.
IRGC state-sponsored operations
- ▪FBI Assistant Director in Charge James C. Barnacle Jr. described the coordinated cyberattacks as a serious threat to U.S. national security.
- ▪The Mabna Institute carried out its cyber campaign on behalf of Iran's Islamic Revolutionary Guard Corps and other Iranian government and university clients.
Academic intellectual property theft
- ▪The stolen academic materials were sold to customers in Iran through one website, while another website sold access to compromised professor accounts to enter university library systems.
- ▪The Mabna Institute stole more than 31 terabytes of academic data and intellectual property, including academic journals, theses, dissertations, and electronic books, valued at approximately $3.4 billion.
DOJ superseding indictment
- ▪Nine of the 17 defendants charged on August 18, 2026, were previously indicted under seal in February 2018 on seven counts related to the hacking campaign.
- ▪The computer-intrusion conspiracy and computer-fraud charges carry maximum five-year prison sentences, wire fraud charges carry maximum 20-year terms, and aggravated identity theft carries a mandatory two-year sentence.
- ▪The unsealed indictment charges the 17 defendants with combinations of conspiracy to commit computer intrusions, conspiracy to commit wire fraud, computer fraud, wire fraud, and aggravated identity theft.
- ▪The U.S. Department of Justice unsealed a 14-count superseding indictment on August 18, 2026, charging 17 Iranian nationals with conducting a coordinated cyber theft campaign.
Rewards for Justice program
- ▪The five defendants targeted by the $10 million reward are Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh.
- ▪The U.S. State Department's Rewards for Justice program announced a reward of up to $10 million for information leading to the location of five defendants.
Story comments
Loading comments…