The U.S. Department of Justice has unsealed a 14-count superseding indictment charging 17 members of Iran-based Mabna Institute with a years-long cyber theft campaign that allegedly stole tens of terabytes of academic data on behalf of the Islamic Revolutionary Guard Corps.[11][3] As part of a coordinated effort, U.S. authorities are offering rewards of up to $10 million for information leading to the identification or location of five key defendants, underscoring the priority Washington places on disrupting Iran-linked cyber operations targeting Western institutions.[10][6]
Prosecutors allege that since at least 2013 the Mabna hackers have conducted a coordinated intrusion campaign against 144 U.S. universities and 178 foreign universities in at least 21 countries, as well as 42 U.S. private sector companies, 11 foreign companies, multiple federal and state agencies, and two non-governmental organizations.[11][2] The indictment states that the defendants exfiltrated more than 31 terabytes of academic data and intellectual property, including research, dissertations, and subscription-only scientific resources, significantly impacting victim institutions and their researchers.[11][12]
According to court filings, the group used large-scale spearphishing and password-spraying attacks to compromise approximately 8,000 professor email accounts worldwide, then leveraged those credentials to siphon data and move laterally within university networks.[11][12][13] Investigators say the Mabna Institute effectively operated as a “hackers-for-hire” shop, contracting with Iranian universities and government-linked clients to obtain access to non-Iranian research, with some taskings attributed to elements of the Islamic Revolutionary Guard Corps.[2][9]
The superseding indictment combines and expands on earlier charges brought in 2018 against nine Mabna-affiliated hackers, adding eight additional defendants and new counts related to computer intrusions and fraud.[1][3] Defendants are charged with conspiracy to commit computer intrusions, conspiracy to commit wire fraud, unauthorized access of protected computers, and aggravated identity theft, with individual counts carrying maximum penalties ranging from five to twenty years in prison.[3][11] All 17 defendants remain at large and are believed to reside in Iran, placing them beyond the immediate reach of U.S. law enforcement but subject to arrest if they travel to cooperating jurisdictions.[6][8]
In a parallel move, the U.S. Treasury’s Office of Foreign Assets Control previously sanctioned the Mabna Institute and several of its personnel for malicious cyber activity, effectively cutting them off from the U.S. financial system and prohibiting U.S. persons from engaging in transactions with them.[4] The FBI has also added multiple Mabna defendants to its cyber most-wanted lists, publishing photos and aliases in an effort to enlist international partners and the public in tracking the hackers’ movements.[8][13]
Security agencies emphasize that the Mabna campaign relied heavily on stolen credentials rather than exploiting newly disclosed software vulnerabilities, highlighting the continued risk posed by weak or reused passwords across university and enterprise environments.[11][13] Advisories from law enforcement and cyber defense agencies urge organizations—particularly in higher education and research—to enforce multifactor authentication on email and cloud services, monitor for anomalous login patterns such as foreign sign-ins to faculty accounts, and rapidly detect and disable suspicious forwarding rules that could be used to silently divert sensitive correspondence.[13][15]
References
- Nine Iranians Charged With Conducting Massive Cyber Theft …
- Nine Iranians Charged With Conducting Massive Cyber …
- 17 Iranians Charged with Conducting Massive Cyber Theft …
- Treasury Sanctions Iranian Cyber Actors for Malicious Cyber …
- Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute
- IRANIAN MABNA HACKERS – FBI
- Indictment of officials from the Mabna Institute
- High Severity Threats | Threat Radar
- 17 Iranians Charged With Conducting Massive Cyber Theft …
- US Charges 9 Iranians With Massive Cyberattack
- Malicious cyber activity of Iran-based Mabna Institute
- View Publications
