Loading threat actor…
Mabna Institute is an Iran-based hacking organization and alleged contractor that has conducted coordinated computer intrusion campaigns since at least 2013. It is widely associated with large-scale credential theft and cyber espionage operations targeting academia, government, private-sector entities, and non-governmental organizations. U.S. authorities have alleged that members of the group operated on behalf of Iran’s Islamic Revolutionary Guard Corps and other Iranian government and university clients, combining state-directed collection with monetization of stolen academic resources. The group is best known for a multi-year campaign against universities worldwide. Its operators reportedly targeted more than 100,000 professor accounts, compromised thousands of academic email accounts, and used stolen credentials to access research, journals, theses, dissertations, electronic books, and other intellectual property. Reported victims included large numbers of universities in the United States and abroad, as well as private companies, U.S. federal and state government agencies, the United Nations, UNICEF, and non-governmental organizations. The operation resulted in the theft and exfiltration of tens of terabytes of academic data and intellectual property. Mabna Institute’s tradecraft has included spearphishing, credential theft, password spraying, unauthorized access to email accounts and online library systems, and data exfiltration. The group has also been linked by U.S. authorities to intrusions against private-sector and government entities beyond academia. Some members were additionally alleged to have participated in the HBO intrusion and attempted extortion operation, indicating overlap between espionage-oriented intrusion activity and financially motivated criminal conduct by individual operators. The organization has also been accused of monetizing stolen academic access by selling or brokering access to compromised university resources for customers in Iran. Known individuals associated by U.S. authorities with Mabna Institute include founders Gholamreza Rafatnejad and Ehsan Mohammadi, along with multiple alleged hackers-for-hire such as Behzad Mesri and others named in U.S. indictments. Overall, Mabna Institute is best characterized as an Iranian intrusion group focused primarily on cyber-enabled theft of academic and commercial information, with strong alleged ties to Iranian state interests.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
72 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-based hacking-for-hire organization accused of conducting coordinated cyber intrusions, spearphishing, credential theft, unauthorized access, and data exfiltration against universities, private companies, government agencies, and NGOs, including selling stolen academic resources and compromised access.
Multi-year computer network exploitation campaign targeting universities globally (including the UK).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.