The Justice Department on Tuesday unsealed a 14-count indictment charging 17 Iranian nationals with orchestrating a sprawling cyber theft campaign that hit American and foreign institutions, allegedly on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC).
The charges, filed in the Southern District of New York, accuse the defendants of being part of the Mabna Institute, an Iran-based company that prosecutors say conducted a "coordinated campaign of cyber intrusions" into the computer systems of at least 144 U.S. universities, 178 foreign universities, and 42 U.S.-based private companies.
According to the DOJ, the Mabna Institute also targeted at least 11 foreign private companies, five U.S. federal and state government agencies, and two nongovernmental organizations. The alleged theft amounted to more than 31 terabytes of academic data and intellectual property, along with email accounts of employees at the affected entities.
Federal prosecutors say the institute carried out the university spear-phishing campaign on behalf of the IRGC and also contracted with other Iranian governmental and private entities to conduct hacking activities. The indictment supersedes a 2018 charging document that had named nine of the defendants.
U.S. Attorney Jamie McDonald for the Southern District of New York said the charges "reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions." He added, "More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad."
The charges range from conspiracy to commit computer intrusions, which carries a maximum sentence of five years in prison, to wire fraud and conspiracy to commit wire fraud, each punishable by up to 20 years. Not all 14 counts apply to every defendant.
The State Department is offering a reward of up to $10 million for information leading to the location of five of the defendants: Saber Shahbazi Ballojeh, Keyvan Fayaz, Mojtaba Galekuhi, Arman Kahzadian, and Behzad Mesri.
The case highlights the ongoing threat of state-sponsored cyber operations, a topic that has drawn increased attention as cyber warfare doctrines evolve and as the U.S. government explores new approaches to countering such attacks, including allowing private firms to conduct cyber operations. The indictment also comes amid broader concerns about cybersecurity, such as recent proposals to boost funding for water system protections.
