US indicts 17 IRGC-linked Iranians in Mabna Institute 31TB hacking campaign; $10 million Rewards for Justice bounty targets IRGC cyber chief Amir Yaryab

US authorities announced parallel actions against IRGC-linked Iranian hackers: the DOJ unsealed a 14-count superseding indictment charging 17 people tied to the Mabna Institute for a campaign running since around 2013 that stole at least 31TB from…

On 2026-09-08, US authorities unveiled two parallel actions against IRGC-linked Iranian hackers. The Justice Department unsealed a 14-count superseding indictment charging 17 people linked to the Mabna Institute, allegedly operating on behalf of the IRGC, in a hacking-for-hire campaign running since around 2013. It breached 144 US universities, 178 foreign universities, 42 US companies, 11 foreign companies, five federal and state agencies (including the Department of Labor, the Federal Energy Regulatory Commission, and Hawaii and Indiana state governments) and UN organizations such as UNICEF, stealing at least 31 terabytes of data and about 8,000 professor email accounts; universities spent roughly $20 million on investigation and remediation. The State Department separately offered a $10 million reward for five individuals tied to the case, including Behzad Mesri, previously indicted for the $6 million HBO extortion. In a distinct but same-day action, the State Department's Rewards for Justice program offered up to $10 million for information identifying or locating Amir Yaryab. The two sources describe his role differently: The Record says he leads the IRGC's Cyber-Electronic Command (CEC), while Cyber Security News says he oversees its Cyber Operations Command. He is linked to CyberAv3ngers, Dadeh Afzar Arman (DAA), Mehrsam Andisheh Saz Nik (MASN) and the Shahid Hemmat and Shahid Shushtari units, which targeted defense, news, shipping, travel, energy, financial and telecommunications sectors in the US, Europe and the Middle East. CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs, including 34 in US water and wastewater facilities, between November 2023 and January 2024, and The Record reports 100+ water-sector entities breached across at least 12 US states since late July amid renewed US-Iran tensions. CISA urged removing internet-exposed PLCs, strong passwords, MFA, firmware updates and VPN-protected remote access.

• DOJ unsealed a 14-count superseding indictment charging 17 people linked to the Mabna Institute, allegedly operating on behalf of the IRGC; 8 were previously indicted in 2018 (The Record, 2026-09-08).
• The campaign, running since around 2013, stole at least 31 terabytes of data and about 8,000 professor email accounts.
• Victims included 144 US universities, 178 foreign universities, 42 US companies, 11 foreign companies, five federal/state agencies (Department of Labor, FERC, Hawaii and Indiana state governments) and UN organizations including UNICEF.
• Universities spent roughly $20 million on investigation and remediation.
• The State Department offered a $10 million reward for five Mabna-linked individuals: Behzad Mesri, Galekuhi, Kahzadian, Fayaz and Shahbazi Ballojeh; Mesri was previously indicted over the $6 million HBO extortion.
• Rewards for Justice is offering up to $10 million for information identifying or locating Amir Yaryab; sources differ on his exact role: The Record says he leads the IRGC's Cyber-Electronic Command (CEC), while Cyber Security News says he…
• Yaryab is linked to CyberAv3ngers, Dadeh Afzar Arman (DAA), Mehrsam Andisheh Saz Nik (MASN), and the Shahid Hemmat and Shahid Shushtari units, which targeted defense, news, shipping, travel, energy, financial and telecommunications sectors…
• CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs, including 34 in US water and wastewater facilities, between November 2023 and January 2024 (Cyber Security News); The Record adds that CyberAv3ngers previously hit US and…