US charges 17 Iranian hackers over 31-terabyte academic data theft

The U.S. has charged 17 alleged members of Mabna Institute, an Iranian hacking-for-hire company accused of running a years-long campaign that stole data from American universities, companies, and government agencies.

The Southern District of New York case adds eight names to the nine already charged back in 2018.

According to the U.S. government, the group stole more than 31 terabytes of academic data and intellectual property. Its targets included 144 U.S. universities and 178 universities abroad, at least 42 U.S. private companies and 11 foreign ones, at least five U.S. federal and state agencies, and at least two non-governmental organizations.

Much of the campaign was carried out for Iran’s Islamic Revolutionary Guard Corps, the intelligence and security arm of the Iranian government, along with other Iranian government and university clients, the indictment states.

Years of spearphishing

“The campaign started in approximately 2013, continued through at least December 2017, and broadly targeted all types of academic data and intellectual property from the systems of compromised universities. Through the course of the conspiracy, U.S.-based universities spent more than approximately $3.4 billion to procure and access such data and intellectual property,” US DoJ said.

The group targeted upwards of 100,000 professor email accounts worldwide through spearphishing, according to the indictment, and got into around 8,000 of them. Once inside, they lifted research papers, theses, dissertations, and academic books spanning science, engineering, medicine, and the social sciences.

The operation also had a resale side. Two websites sold the stolen material to buyers inside Iran, including public universities. One of them let paying customers log into compromised professor accounts to reach U.S. and foreign university library systems directly.

Several of the accused are tied to intrusions at companies and government bodies outside higher education, including the U.S. Department of Labor and the Federal Energy Regulatory Commission, with more than $20 million in remediation costs cited by prosecutors.

One of the highlighted victims in the announcement was HBO. One defendant is accused of hacking the company, stealing internal data, and trying to extort it for around $6 million in bitcoin. Four others in the new indictment are linked to that intrusion.

US puts a price on finding the hackers

The State Department’s Rewards for Justice program is offering up to $10 million for information on the whereabouts of five defendants named in the indictment.

“More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad,” noted U.S. Attorney Jamie McDonald for the Southern District of New York.

“Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength,” added McDonald.

If convicted, the individuals face up to 20 years in prison on wire fraud counts alone, on top of conspiracy, computer fraud, and identity theft charges.

None of the defendants are in U.S. custody. Given the diplomatic relationship between Washington and Tehran, an arrest looks unlikely anytime soon.