Seventeen members of Iran’s Mabna Institute now face US charges over a hacking spree that ran for more than a decade. The superseding indictment, unsealed August 18 in the Southern District of New York, accuses the group of running the campaign for the Islamic Revolutionary Guard Corps.
The alleged targets are staggering: 144 US universities, 42 US private companies, at least five federal and state agencies, and numerous foreign organizations since 2013. More than 100,000 professor accounts were targeted and 8,000 compromised, with over 31TB of academic data and intellectual property stolen. Some of the data was sold, the indictment says.
Nine defendants carry over from the original seven-count indictment unsealed in 2018. The new 14-count filing carries per-offense sentences of two to 20 years, and the State Department’s Rewards for Justice program offers up to $10 million for information leading to several of the accused.
The institute was founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi to help Iranian universities and research bodies steal non-Iranian scientific resources. Compromised email accounts included five US government agencies, 42 US companies, and 11 foreign firms, among them HBO.
US universities spent roughly $3.4 billion to procure and access the stolen data and intellectual property, according to the filing.
The operation was a sweeping state-sponsored effort to lift research and intellectual property from American universities, businesses, and government institutions, in the words of US Attorney Jamie McDonald.
