The U.S. Department of Justice has filed a 14-count superseding indictment against 17 individuals linked to Iran’s Mabna Institute, accusing them of executing a years-long cyber espionage campaign that allegedly stole at least 31.5 terabytes of research data and intellectual property. Prosecutors say the operation ran from around 2013 until late 2017, working for Iranian government bodies and university clients, including the Islamic Revolutionary Guard Corps (IRGC).([cybersecuritynews.com](https://cybersecuritynews.com/doj-charges-17-iranian-hackers/))
How the Theft Worked
The network reportedly targeted over 100,000 academic professors globally, compromising roughly 8,000 of their email accounts. This included 144 universities in the U.S. and 178 abroad. The locations spanned Australia, Canada, China, Europe, the Middle East, Asia, and the U.K. Attackers are said to have used spearphishing emails to steal credentials, then accessed university systems and online library portals. What was taken included scientific and engineering research, medical and social science dissertations and journals, e-books, theses, and other controlled content.([cybersecuritynews.com](https://cybersecuritynews.com/doj-charges-17-iranian-hackers/))
Besides academia, the indictment alleges the group attacked numerous private sector companies, government agencies, and international bodies. Victims cited include the U.S. Department of Labor, the Federal Energy Regulatory Commission, the states of Hawaii and Indiana, UNICEF, and the United Nations.([cybersecuritynews.com](https://cybersecuritynews.com/doj-charges-17-iranian-hackers/))
Monetizing the Stolen Data & Legal Exposure
Prosecutors state that Mabna monetized its haul by selling stolen academic content and direct access to compromised library systems. Two Iran-based sites—Megapaper.ir and Gigapaper.ir—are named as platforms used to distribute stolen materials and user credentials to customers.([cybersecuritynews.com](https://cybersecuritynews.com/doj-charges-17-iranian-hackers/))
The legal accusations are substantial. The expanded indictment adds eight more defendants to the case initially unsealed in 2018. Charges include conspiracy to commit computer intrusions, wire fraud, unauthorized access for private financial gain, and aggravated identity theft.([cybersecuritynews.com](https://cybersecuritynews.com/doj-charges-17-iranian-hackers/))
The estimated damage is more than just the cost of stolen content. U.S. universities reportedly spent upward of $3.4 billion to acquire the targeted research and intellectual property. Investigating and cleaning up the breaches cost victims over $20 million.([cybersecuritynews.com](https://cybersecuritynews.com/doj-charges-17-iranian-hackers/))
As part of the crackdown, the State Department’s Rewards for Justice program is offering up to $10 million for information leading to the arrest of five key defendants. These include Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh. The indictment remains an allegation, and all defendants are presumed innocent until proven guilty.([cybersecuritynews.com](https://cybersecuritynews.com/doj-charges-17-iranian-hackers/))
The Mabna Institute was founded by Gholamreza Rafatnejad and Ehsan Mohammadi with the stated mission of providing Iranian institutions access to foreign scientific materials. Prosecutors allege the group also used hackers-for-hire to carry out much of the phishing, credential theft, reconnaissance, password spraying, and data exfiltration.([cybersecuritynews.com](https://cybersecuritynews.com/doj-charges-17-iranian-hackers/))
This case marks one of the more sweeping academic IP theft charges in recent years, and it highlights the increasingly blurred line between state-sanctioned espionage and intellectual property theft for profit. With substantial financial costs and global victims, it’s likely to prompt tighter security around academic access and cross-border cooperation on cybercrime enforcement. Keep an eye on whether any of the five wanted individuals are extradited or charged, how universities respond to prevent future pilferage, and whether laws or international agreements change to address this kind of research theft at scale.
