The U.S. Justice Department has charged 17 Iranian nationals for their alleged involvement in a hacking-for-hire operation that stole academic research and intellectual property from American organizations over several years. The defendants are said to be affiliated with Mabna Institute, and nine of them were previously charged in a March 2018 indictment for attacks on more than 300 universities and private companies. The newly named eight individuals are accused of stealing emails, proprietary information, and other sensitive data as part of a broader network tied to the Islamic Revolutionary Guard Corps and other Iranian government entities.
The scheme, which the government says began around 2013, targeted the accounts of more than 100,000 professors worldwide, successfully compromising roughly 8,000 accounts. Through those accounts, the hackers allegedly stole 31.5 terabytes of academic data, including journals, theses, dissertations, and ebooks, valued at approximately $3.4 billion. The operation affected 178 universities, with 144 of those located in the United States, as well as at least 53 private firms, two NGOs, and 10 U.S. state agencies.
U.S. Attorney Jamie McDonald said the charges reveal a broader network behind a sweeping, state-sponsored campaign to steal research and intellectual property from American institutions. McDonald also stated that the passage of time since the original indictment, which was made public more than eight years ago, will not deter authorities from identifying and pursuing those who target the United States from abroad. The new charges include conspiracy to commit computer intrusions, wire fraud, unauthorized access for financial gain, and aggravated identity theft, with maximum penalties of up to 20 years in prison.
Among the victims highlighted in the announcement was HBO, which was reportedly extorted for $6 million worth of Bitcoin. The State Department has announced rewards of up to $10 million for information leading to the whereabouts of five defendants: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh. A Tor link has been provided for anonymous submissions, and all defendants are presumed innocent until proven guilty in a court of law.
The charges come alongside a separate report on cybersecurity defenses, noting that prevention scores can hide what happens after initial access, as protection drops sharply when attackers use valid credentials. That analysis, based on 338 million simulations in customer production environments, measures defenses technique by technique. These developments follow other enforcement actions, including the seizure of a VPN service used in ransomware and data theft attacks.
