U.S. indicts hackers over terabytes worth of intellectual property theft

The Trump administration has announced plans to indict and sanction multiple hackers who act as contractors for a secretive branch of Iran's armed forces.

The Trump administration has announced indictments and sanctions against multiple hackers who acted as contractors for a secretive branch of Iran’s armed forces.

On Friday, the Justice Department unsealed charges against nine Iranian nationals for hacking into the networks of multiple U.S. universities, municipal and federal government agencies and other American businesses. The hackers allegedly sought to steal valuable academic research and leverage the high bandwidth networks for future operations.

A senior U.S. official who spoke on condition of anonymity explained the Trump administration believes the punishment will be more damaging than similar indictments against other nation-states that have attacked U.S. companies, like Russia or China. This is because many of those named Friday are private citizens that currently enjoy the ability to travel internationally and some may even own assets abroad. Government officials do not expect the same impact on those indicted in previous instances.

“These nine Iranian nationals allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 American companies, five American government agencies, and also more than 176 universities in 21 foreign countries,” Deputy Attorney General Rod Rosenstein said in a statement. “For many of these intrusions, the defendants acted at the behest of the Iranian government and, specifically, the Iranian Revolutionary Guard Corps.”

All of the individuals facing charges worked for the Mabna Institute, a quasi-government technology company based in Iran. In the past, this company has hacked both for profit and country.

“We’re focusing on people who support IRGC (Islamic Revolutionary Guard Corps) in some of their cyber operations,” the senior U.S. official told CyberScoop. “They have this dual personality where they’ve been hacking for profit as well as hacking information, which they sell to the Iranian government, as well as provide capabilities to the Iranian government.”

The Mabna Institute has helped the IRGC with their offensive cyber operations in the past by providing them with compromised computer networks to launch attacks from.

“The theme is that Iran is a nation state that doesn’t seem to clean up those quasi-government supported elements,” the official added. “So this is a place where sanctions or indictments could have real effect. Because unlike an intel officer, we’re going to hit a commercial entity … the people in that ecosystem worry about their ability to travel. We like that you can see this is going to squeeze them pretty hard.”

The Department of Justice, FBI and Department of the Treasury have each been involved in designing and delivering Friday’s dual action of indictments and sanctions.

“I would call it a change in strategy in that we’re enforcing norms,” the senior official said.

U.S. Attorney Geoffrey Berman of the Southern District of New York, whose division helped work the case, explained that the Iranian hackers “targeted innovations and intellectual property from our country’s greatest minds.”

“These defendants are now fugitives from American justice, no longer free to travel outside Iran without risk of arrest. The only way they will see the outside world is through their computer screens, but stripped of their greatest asset – anonymity,” Berman said in a statement.

Hours after the original announcement by the Justice Department, the British government followed suit in blaming Iran.

You can read the full indictment below.

[documentcloud url=”http://www.documentcloud.org/documents/4419670-U-S-v-Rafatnejad-Et-Al-Indictment-0.html” responsive=true]

Treasury sanctions alleged Iranian hackers as part of ‘economic D-Day’

It’s a follow-up to an indictment the Justice Department unsealed last week against people affiliated with the Mabna Institute.

AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn

U.S., South Korean government agencies caution to be on lookout for Gunra ransomware gang

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure