The U.S. Department of Justice has unveiled a superseding indictment against 17 individuals linked to the Iran-based Mabna Institute. They are accused of orchestrating an extensive cyber espionage operation that resulted in the theft of at least 31.5 terabytes of research data and proprietary information.
Background of the Cyber Campaign
Initiated in 2013 and continuing until at least December 2017, the operation primarily served Iranian governmental and academic interests, including the Islamic Revolutionary Guard Corps (IRGC). The indictment outlines a sustained cyber intrusion campaign targeting universities, private enterprises, and governmental bodies globally.
The Mabna Institute was reportedly founded by Gholamreza Rafatnejad and Ehsan Mohammadi, aiming to provide Iranian entities with unauthorized access to international scientific data and resources.
Methods and Impact of the Cyber Attacks
The hackers employed various tactics, including phishing, reconnaissance, credential theft, and data exfiltration, to breach over 100,000 professor accounts worldwide. Approximately 8,000 academic email accounts were compromised, affecting 144 universities in the U.S. and 178 overseas.
Targeted institutions spanned continents, including Australia, Canada, China, Europe, the Middle East, Asia, and the UK. The operation involved accessing university networks to obtain academic journals, dissertations, and other scholarly works, resulting in significant intellectual property theft.
It is estimated that U.S. universities alone spent over $3.4 billion on acquiring the targeted research and data.
Monetization and Broader Implications
The stolen academic materials were monetized through Iranian websites, Megapaper.ir and Gigapaper.ir, which sold the content and access to compromised academic accounts. Megapaper provided stolen resources to Iranian customers, while Gigapaper offered direct access to university library systems via hijacked credentials.
Beyond academia, the indictment reveals that the Mabna Institute also targeted numerous private-sector companies and government entities, including the U.S. Department of Labor and the United Nations. The case, first announced in 2018, now includes eight additional defendants.
The defendants face charges including conspiracy to commit computer intrusions, wire fraud, unauthorized access for financial gain, and aggravated identity theft. The intrusions have led to over $20 million in investigation costs for the victims.
Ongoing Investigations and Legal Proceedings
The State Department’s Rewards for Justice program is offering up to $10 million for information leading to the whereabouts of five key suspects. The allegations remain unproven until adjudicated in court, with all defendants presumed innocent until proven guilty.
