Federal prosecutors unsealed a 14-count superseding indictment charging 17 individuals tied to an Iran-based hacking organization known as the Mabna Institute for carrying out massive cyberattacks against hundreds of universities, private businesses, government agencies, and non-governmental organizations worldwide.
According to court filings, the hackers stole more than 31 terabytes of academic research, intellectual property, and proprietary email records between 2013 and at least late 2017. Investigators found that the group conducted many of these intrusions on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC) and other Iranian government clients.
Nine of the 17 defendants were previously charged in an initial 2018 indictment, while the updated filing adds eight new defendants. The case is assigned to U.S. District Judge Jesse M. Furman in the Southern District of New York.
The Mabna Institute was founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi to obtain unauthorized access to non-Iranian scientific data.
Over several years, the group targeted more than 100,000 email accounts belonging to professors, ultimately compromising roughly 8,000 accounts across 144 U.S. universities and 178 institutions in countries such as the United Kingdom, Germany, Canada, Japan, and Switzerland. Prosecutors noted that U.S. universities spent over $3.4 billion to procure the academic journals, dissertations, and research files the hackers took.
The stolen material spanned engineering, medicine, technology, and the social sciences. The defendants transferred the exfiltrated records to overseas servers and distributed them through two websites, Megapaper.ir and Gigapaper.ir, where customers inside Iran could purchase stolen research or buy direct access to compromised university library networks.
Beyond academic institutions, the group breached employee accounts at 42 U.S. companies, 11 foreign firms, five U.S. federal and state agencies, and international bodies including the United Nations, UNICEF, the U.S. Department of Labor, and the Federal Energy Regulatory Commission.
The new indictment also details attacks on private sector firms like Home Box Office (HBO), where several defendants attempted to extort millions of dollars in Bitcoin, as well as separate corporate intrusions that resulted in over $20 million in investigation and cleanup costs for victims.
“The superseding indictment alleges that, at the behest of entities including the IRGC, these defendants hacked into universities and other research institutions worldwide, including the United States, stealing at least 31 terabytes of information and intellectual property of untold value,” said Assistant Attorney General for National Security John A. Eisenberg. “The National Security Division is committed to protecting the United States from such predators and will pursue those who perpetrate such crimes for as long as it takes to bring them to justice.”
“Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” said U.S. Attorney Jamie McDonald for the Southern District of New York. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad. Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength. This office and our partners will continue to protect American innovation and pursue accountability for the individuals behind these attacks.”
“These defendants allegedly built and profited from a sprawling hacking-for-hire operation that targeted the intellectual property of American and allied universities, companies, and government agencies for the benefit of the Iranian government,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “Today’s charges make clear to cyber adversaries everywhere: the FBI’s memory is long, and time will not blunt our resolve to pursue justice. The FBI will continue working with law enforcement and private sector partners to identify malicious cyber actors, disrupt their operations, and impose real cost on them, wherever they operate.”
Alongside the indictment, the U.S. State Department’s Rewards for Justice program announced a reward of up to $10 million for information leading to the location of five charged defendants: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh. The prosecution is led by the U.S. Attorney’s Office for the Southern District of New York in coordination with the Justice Department’s National Security Division, the FBI, and the United Kingdom’s National Crime Agency.
READ: Federal Monitors Head To Florida And Wyoming Polls For Primary Elections
Please make a small donation to the Tampa Free Press to help sustain independent journalism. Your contribution enables us to continue delivering high-quality, local, and national news coverage.
Sign up: Subscribe to our free newsletter for a curated selection of top stories delivered straight to your inbox.
