DOJ charges 17 in Iran-linked Mabna Institute university hacking case

A 14-count superseding indictment unsealed today charges 17 alleged members of the Mabna Institute, an Iran-based company, with participating in a years-long cyber-intrusion campaign targeting 144 U.S. universities, 178 foreign universities, at least 42 U.S. private-sector companies, at least 11 foreign companies, at least five U.S. federal and state government agencies, and at least two nongovernmental organizations, according to the Justice Department.

Prosecutors allege that the campaign, which began around 2013 and continued through at least December 2017, resulted in the theft of approximately 31.5 terabytes of academic data and intellectual property, as well as the compromise and exfiltration of employee email accounts at companies, government agencies and NGOs.

According to the indictment, the defendants conducted many of the alleged intrusions on behalf of Iran’s Islamic Revolutionary Guard Corps, as well as other Iranian government and university clients. Nine of the 17 defendants named in the superseding indictment were previously charged in a seven-count indictment announced in March 2018, prosecutors said. The case has been assigned to U.S. District Judge Jesse M. Furman.

“The superseding indictment alleges that, at the behest of entities including the IRGC, these defendants hacked into universities and other research institutions worldwide, including the United States, stealing at least 31 terabytes of information and intellectual property of untold value,” said Assistant Attorney General for National Security John A. Eisenberg.

U.S. Attorney Jamie McDonald for the Southern District of New York said the eight newly added defendants reveal a broader network allegedly behind the operation. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad,” McDonald said. FBI Cyber Division Assistant Director Brett Leatherman said the defendants “allegedly built and profited from a sprawling hacking-for-hire operation,” adding that “the FBI’s memory is long, and time will not blunt our resolve to pursue justice.”

Prosecutors allege that Gholamreza Rafatnejad and Ehsan Mohammadi founded the Mabna Institute around 2013. The institute allegedly targeted more than 100,000 professor accounts worldwide and successfully compromised approximately 8,000 of them. Stolen academic resources were also allegedly sold through Megapaper and Gigapaper. Megapaper was operated by a company controlled by defendant Abdollah Karima, while Gigapaper was affiliated with him, according to the indictment.

Beyond universities, the indictment alleges that the defendants compromised and exfiltrated employee email accounts at federal and state agencies, including the U.S. Department of Labor and the Federal Energy Regulatory Commission, as well as at governmental and nongovernmental organizations including the United Nations and UNICEF. Defendant Behzad Mesri was separately charged in connection with a 2017 hack of HBO in which prosecutors allege he attempted to extort the company for approximately $6 million worth of Bitcoin. Five other defendants named in the superseding indictment were also allegedly directly involved in the HBO intrusion.

The State Department’s Rewards for Justice program is offering up to $10 million for information leading to the location of defendants Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz and Saber Shahbazi Ballojeh. An indictment is merely an allegation, and all defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.