Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute

The superseding indictment adds defendants and allegations against the Iranian firm accused of a massive cybertheft campaign against foreign universities and others.

Federal authorities on Tuesday unsealed an indictment against 17 Iranians affiliated with the tech firm Mabna Institute, alleging a campaign of vast cybertheft on behalf of the Iranian government against universities, governments and companies.

It’s a second wave of indictments against the Tehran-based firm, expanding on and replacing a 2018 indictment of nine of the defendants from then and adding others. 

“Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” said Jamie McDonald, U.S. Attorney for the Southern District of New York. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad.”

Unlike in 2018, the United States is currently waging a war against Iran that recently saw a 60-day negotiation deadline pass with no progress.

“Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength,” McDonald continued.

According to the Justice Department, Gholamreza Rafatnejad and Ehsan Mohammadi founded the Mabna Institute around 2013 with the goal of helping Iranian universities and scientific and research organizations to steal from foreign scientific efforts. In doing so, it paid hackers-for-hire listed in the indictment.

The institute has compromised more than 100,000 professors’ email accounts globally, the indictment alleges, and successfully compromised 8,000 accounts at 144 U.S. universities and 178 universities in other parts of the world.

Its hackers used stolen credentials to take academic journals, dissertations and e-books across all fields of research, at least 31.5 terabytes worth in total. The institute sometimes sold stolen data, according to the indictment. 

“Through the course of the conspiracy, U.S.-based universities spent more than approximately $3.4 billion to procure and access such data and intellectual property,” a press release on the indictment states.

The defendants also have compromised and stolen from email accounts for at least five U.S. federal and state government agencies, 42 U.S. companies and 11 foreign companies, among them HBO. 

In all, the indictment brings 14 separate, sometimes overlapping charges against the 17 defendants, with sentences for each offense ranging from two to 20 years.

In conjunction with the indictment, the State Department’s Rewards for Justice program is offering up to $10 million for information leading to the location of four of the defendants.

SCOTUS tosses one of two injunctions against Trump USPS mail-in ballot rules

The 6-3 decision dismisses one lawsuit brought by states, saying they have no standing to sue because the disputed sections “neither requires nor forbids anything of anyone outside…

Treasury sanctions alleged Iranian hackers as part of ‘economic D-Day’

764 splinter group leader sentenced to 40 years in jail

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

• FBI raises alarm over deceptive phishing campaign targeting prominent people

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure