17 Iranians charged in major cybercrime case in New York

Since at least 2013, Mabna hackers have “conducted a coordinated campaign of cyber intrusions into computer systems for 144 U.S.-based universities, 178 foreign universities, at least 42 U.S.-based private sector companies, at least 11 foreign private sector companies, at least five U.S. federal and state government agencies, and at least two non-governmental organizations,” according to a 14-count superseding indictment unsealed Tuesday.  

Mabna Institute hackers “stole more than 31 terabytes of academic data and intellectual property from these universities, as well as the email accounts of employees at the private sector companies, government agencies, and NGOs,” in order to gather intelligence for the IRGC, according to the charges.

The 17 hackers were indicted on 14 counts of computer and wire fraud and identity theft charges. Nine of the hackers were charged in a 7-count indictment in 2018. The FBI also issued a most wanted bulletin, stating they were considered an international flight risk.

The charges reveal a “broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” U.S. Attorney Jamie McDonald said. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad. Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength.”

The Mabna Institute, based in Tehran, was reportedly founded by Iranians Gholamreza Rafatnejad and Ehsan Mohammadi in 2013 “to assist Iranian universities and scientific and research organizations in stealing access to non-Iranian scientific resources,” the complaint states. They contracted hackers-for-hire to steal academic data, intellectual property, email inboxes, and other proprietary data. They also contracted with Iranian governmental and private entities to hack on their behalf, according to the complaint. 

Mabna hackers targeted more than 100,000 email accounts of professors worldwide, successfully compromising 8,000 email accounts across 144 U.S.-based universities and 178 universities in multiple countries, according to the complaint. Through the hacked emails, they stole credentials to access and steal academic research, journals, theses, dissertations, and electronic books and other information and sold it. 

In response, U.S.-based universities spent more than $3.4 billion to procure and access stolen intellectual property. Private sector companies lost tens of millions of dollars, according to the complaint. 

The U.S. Department of State’s Rewards for Justice program is offering a $10 million reward for information leading to the location of five defendants: Behzad Mesri; Mojtaba Galekuhi, also known as Mojtaba Ghaleh Koui; Arman Kahzadian; Keyvan Fayaz, also known as Achilles, The Joker and bc.monster; and Saber Shahbazi Ballojeh.

Anyone with information about the alleged hackers is encouraged to contact the FBI, the nearest American Embassy or Consulate or the DOJ’s Rewards for Justice through a Tor-based tips-reporting channel at he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion.

If the defendants are caught and prosecuted they each face decades in prison.