Loading story…
The U.S. Department of Justice unsealed a 14-count superseding indictment charging 17 Iranian nationals tied to the Tehran-based Mabna Institute with conducting a long-running cyber intrusion and theft campaign on behalf of the Islamic Revolutionary Guard Corps and other Iranian government and university clients. Prosecutors allege the operation, active since at least 2013, compromised more than 100,000 professors’ email accounts worldwide, including about 8,000 accounts across 144 U.S. universities and 178 foreign universities, and stole at least 31.5 terabytes of academic research, intellectual property, and email contents.
Authorities said the campaign also targeted at least five U.S. federal and state agencies, dozens of companies in the United States and abroad, NGOs, and media targets including HBO, with several defendants linked to the separate HBO hack-and-extortion case. The superseding indictment expands a 2018 case by adding eight defendants and alleges the stolen academic materials were monetized through Megapaper.ir and Gigapaper.ir; U.S. officials said American universities alone spent roughly $3.4 billion to procure and access the stolen data, while the State Department is offering up to $10 million for information leading to several of the accused.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The U.S. State Department's Rewards for Justice program announced up to $10 million for information leading to the location of five defendants named in the superseding indictment.
On August 18, 2026, the U.S. Department of Justice unsealed a 14-count superseding indictment charging 17 Iranian nationals affiliated with the Mabna Institute over a long-running cybertheft campaign. The new case expands and replaces the 2018 indictment, adding eight defendants and alleging broader targeting of universities, companies, government agencies, and NGOs.
The superseding indictment alleges the Mabna Institute's cyber-enabled theft campaign continued until at least March 2022, extending the previously documented timeline well beyond 2017. The filing also ties this longer-running operation to large-scale theft from universities worldwide.
The DOJ previously announced a 7-count indictment in March 2018 charging nine of the 17 defendants later named in the superseding case.
The indictment alleges the university-focused hacking operation ran from approximately 2013 through at least December 2017, compromising thousands of professor accounts and stealing academic data.
The DOJ alleges the Mabna Institute began a coordinated cyber intrusion campaign in or around 2013, including spearphishing against universities and intrusions targeting professors, companies, government agencies, and NGOs.
According to the superseding indictment, Gholamreza Rafatnejad and Ehsan Mohammadi founded the Mabna Institute around 2013 to help Iranian universities and research organizations steal foreign scientific materials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcemalware.news
Open sourcenextgov.com
Open sourcebleepingcomputer.com
Open sourcesecurityweek.com
Open sourcecyberscoop.com
Open sourcejustice.gov
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities indicted three Iranian nationals—**Said Pourkarim Arabi, Mohammad Reza Espargham, and Mohammad Bayati**—for cyber intrusions conducted between 2015 and 2019 against aerospace and satellite technology companies, alleging they stole sensitive commercial information, intellectual property, and personal data on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. Reporting on the case linked the activity to Iranian espionage tradecraft associated with **Elfin (`APT33`)**, including spear-phishing, use of the **NanoCore RAT**, exploitation of **`CVE-2018-20250`** in WinRAR, and follow-on intrusion activity using malicious HTA files, `mshta.exe`, and PowerShell in regional targeting such as Saudi Arabia. The enforcement action aligns with broader U.S. efforts against Iranian cyber operators, including **OFAC sanctions** on **APT39 (Chafer)**, the **Rana Intelligence Computing Company** front, and MOIS-linked personnel for surveillance and intrusions targeting Iranian citizens, neighboring governments, and foreign organizations. Separate threat research also described an Iranian espionage campaign dubbed **Operation GhostShell**, which targeted aerospace and telecommunications firms across the Middle East, the United States, Russia, and Europe with the **ShellClient** RAT, a stealthy backdoor that disguised itself as legitimate Windows components and in newer variants used the **Dropbox API** for command-and-control.
Aug 15, 2026
US federal prosecutors indicted **Samaneh Ghandali** and **Soroor Ghandali** (former Google engineers) and **Mohammadjavad Khosravi** (Samaneh’s husband, employed at another unnamed tech firm) for alleged **trade secret theft**, **conspiracy**, and **obstruction of justice** tied to the exfiltration of sensitive processor-related information. The Department of Justice alleges the trio used their roles at multiple Silicon Valley companies to access and steal confidential documents covering **processor security** and **cryptography**, and moved the material to unauthorized third-party and personal locations, including destinations linked to **Iran**. Investigators allege the activity included transferring large volumes of internal files to external communications platforms and sharing them in channels associated with the defendants, with additional copies later found on personal devices and systems connected to the group. Prosecutors also claim the defendants attempted to conceal the scheme through actions such as destroying records, making false statements, and photographing screens to avoid direct document transfers. Google said it enhanced safeguards and alerted law enforcement after discovering the incident; the alleged stolen trade secrets reportedly included information related to Google’s **Tensor** processor used in *Pixel* phones.
Jun 29, 2026
U.S. authorities tied Iran to a multi-stage influence operation aimed at the 2020 presidential election, including spoofed **Proud Boys** emails that threatened Democratic voters, theft of data from a misconfigured state voter system affecting more than **100,000** voters, and a disinformation video that falsely portrayed election infrastructure as compromised. FBI and CISA alerts said the actors used voter intimidation emails, spoofed media sites, propaganda, and infrastructure that included VPN-backed IP addresses, while warning that parts of the video appeared staged for psychological effect even though the operators were likely capable of exploiting common web vulnerabilities. The campaign continued after Election Day with the **"Enemies of the People"** website, which published personal information and death threats against election officials, security leaders, governors, and voting-system personnel who rejected fraud claims. The U.S. later charged **Seyyed Mohammad Hosein Musa Kazemi** and **Sajjad Kashian**, alleged contractors for Iran-linked **Emennet Pasargad**, and imposed sanctions on the company, other Iranian nationals, and IRGC-linked entities; separate Justice Department actions also seized dozens of domains allegedly used by the IRGC to run covert propaganda outlets targeting U.S. audiences.
Aug 15, 2026