U.S. charges 17 linked to Mabna Institute in hacking campaign against 322 universities

The U.S. Department of Justice announced a new, expanded 14‑count indictment charging 17 people tied to the Mabna Institute with a global hacking campaign that targeted universities, companies, government bodies and non‑governmental organisations.

According to the indictment, from at least 2013 the group carried out intrusions against 144 U.S. universities and 178 foreign universities — a total of 322 higher‑education institutions — and also targeted at least 42 U.S. and 11 foreign companies, five U.S. government entities and two NGOs. Investigators say the hackers stole more than 31 terabytes of academic materials, intellectual property and staff email content.

U.S. authorities assert that many of the operations were carried out on behalf of the Islamic Revolutionary Guard Corps (IRGC) and other Iranian state institutions. Nine of the defendants had already been charged in March 2018; the new indictment adds eight more individuals.

How the scheme operated

Prosecutors say the Mabna Institute was founded in 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi. The two allegedly recruited a network of hackers who copied academic papers, research, books, theses, passwords and other protected information. More than 100,000 professor profiles were reportedly targeted, and roughly 8,000 university email accounts were compromised in the United States and about twenty other countries.

The stolen material covered the natural and technical sciences, engineering, medicine, the social sciences and other fields. The defendants are accused of using stolen usernames and passwords to access university systems and download academic journals, theses, dissertations and electronic books. U.S. universities had previously spent about $3.4 billion for legal access to those materials.

Some of the purloined content is alleged to have been sold through Iranian websites called "Megapaper" and "Gigapaper," giving users inside Iran access to restricted academic resources and, in some cases, direct use of compromised foreign professors' accounts.

The intrusions extended beyond academia. Affected organisations include the U.S. Department of Labor, the Federal Energy Regulatory Commission (FERC), the states of Hawaii and Indiana, the United Nations and UNICEF. Prosecutors also say some defendants are linked to the HBO hack and an attempted bitcoin extortion of about $6 million. The U.S. State Department has offered a reward of up to $10 million for information leading to the location of five of the accused.

Separately in the broader regional context, the United Arab Emirates has banned trade with Iran. Reports circulating in parallel also allege that Iran offers its citizens $30,000 for each captured or killed American soldier.

Photo: Thawatchai Chawong / Panthermedia / Profimedia