Loading story…
The U.S. Department of Justice unsealed a 14-count superseding indictment charging 17 Iranian nationals tied to the Tehran-based Mabna Institute with conducting a long-running cyber intrusion and theft campaign on behalf of the Islamic Revolutionary Guard Corps and other Iranian government and university clients. Prosecutors allege the operation, active since at least 2013, compromised more than 100,000 professors’ email accounts worldwide, including about 8,000 accounts across 144 U.S. universities and 178 foreign universities, and stole at least 31.5 terabytes of academic research, intellectual property, and email contents.
Authorities said the campaign also targeted at least five U.S. federal and state agencies, dozens of companies in the United States and abroad, NGOs, and media targets including HBO, with several defendants linked to the separate HBO hack-and-extortion case. The superseding indictment expands a 2018 case by adding eight defendants and alleges the stolen academic materials were monetized through Megapaper.ir and Gigapaper.ir; U.S. officials said American universities alone spent roughly $3.4 billion to procure and access the stolen data, while the State Department is offering up to $10 million for information leading to several of the accused.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
The U.S. State Department's Rewards for Justice program announced up to $10 million for information leading to the location of five defendants named in the superseding indictment.
On August 18, 2026, the U.S. Department of Justice unsealed a 14-count superseding indictment charging 17 Iranian nationals affiliated with the Mabna Institute over a long-running cybertheft campaign. The new case expands and replaces the 2018 indictment, adding eight defendants and alleging broader targeting of universities, companies, government agencies, and NGOs.
The superseding indictment alleges the Mabna Institute's cyber-enabled theft campaign continued until at least March 2022, extending the previously documented timeline well beyond 2017. The filing also ties this longer-running operation to large-scale theft from universities worldwide.
The DOJ previously announced a 7-count indictment in March 2018 charging nine of the 17 defendants later named in the superseding case.
The indictment alleges the university-focused hacking operation ran from approximately 2013 through at least December 2017, compromising thousands of professor accounts and stealing academic data.
The DOJ alleges the Mabna Institute began a coordinated cyber intrusion campaign in or around 2013, including spearphishing against universities and intrusions targeting professors, companies, government agencies, and NGOs.
According to the superseding indictment, Gholamreza Rafatnejad and Ehsan Mohammadi founded the Mabna Institute around 2013 to help Iranian universities and research organizations steal foreign scientific materials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
17 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcecyberscoop.com
Open sourcejustice.gov
Open sourcejustice.gov
Open sourcego.rewardsforjustice.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amir Barati, an Iranian-Turkish national accused by U.S. authorities of participating in an Iranian state-linked academic espionage operation, has been extradited from Montenegro to the United States following his June 25 arrest. He faces a 14-count indictment including conspiracy to commit computer intrusions, wire fraud, computer fraud, and identity theft. Prosecutors allege Barati was a key member of the Iran-based Mabna Institute, which operated on behalf of the Islamic Revolutionary Guard Corps from 2013 to 2017. The alleged campaign targeted universities, research institutions, private organizations, government agencies, and NGOs globally, compromising thousands of academic email accounts and stealing more than 31 TB of research, intellectual property, and employee account data. U.S. officials say the stolen material was provided to the Iranian government and sold to Iranian universities, causing claimed losses exceeding $3.4 billion.
Oct 5, 2026
U.S. authorities indicted three Iranian nationals—**Said Pourkarim Arabi, Mohammad Reza Espargham, and Mohammad Bayati**—for cyber intrusions conducted between 2015 and 2019 against aerospace and satellite technology companies, alleging they stole sensitive commercial information, intellectual property, and personal data on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. Reporting on the case linked the activity to Iranian espionage tradecraft associated with **Elfin (`APT33`)**, including spear-phishing, use of the **NanoCore RAT**, exploitation of **`CVE-2018-20250`** in WinRAR, and follow-on intrusion activity using malicious HTA files, `mshta.exe`, and PowerShell in regional targeting such as Saudi Arabia. The enforcement action aligns with broader U.S. efforts against Iranian cyber operators, including **OFAC sanctions** on **APT39 (Chafer)**, the **Rana Intelligence Computing Company** front, and MOIS-linked personnel for surveillance and intrusions targeting Iranian citizens, neighboring governments, and foreign organizations. Separate threat research also described an Iranian espionage campaign dubbed **Operation GhostShell**, which targeted aerospace and telecommunications firms across the Middle East, the United States, Russia, and Europe with the **ShellClient** RAT, a stealthy backdoor that disguised itself as legitimate Windows components and in newer variants used the **Dropbox API** for command-and-control.
Aug 15, 2026
The U.S. Treasury sanctioned five Iranian nationals for alleged cyber intrusions, data theft, and misuse of stolen business information tied to Iran’s Ministry of Intelligence and Security (**MOIS**). U.S. officials said the group had targeted critical infrastructure, government entities, and international organizations since at least late 2023, with victims spanning the energy, defense, healthcare, information technology, and finance sectors. Treasury said some of the accused also pursued personal financial gain and, in some cases, targeted Iranian companies in addition to foreign organizations. The sanctions were announced amid broader U.S. and U.K. warnings about Iranian cyber activity affecting operational technology environments. Officials linked the action to ongoing concern over attacks on U.S. water systems and a reported disruption at a small British power plant, underscoring the risk to industrial control systems and **programmable logic controllers** (`PLCs`) used across energy, water, and agriculture. The move also aligns with a wider campaign against Iranian cyber operators, including a recently unsealed U.S. indictment involving alleged affiliates of the Tehran-based Mabna Institute.
Aug 25, 2026