DOJ Charges 17 Iranian Hackers in Massive Data Theft Campaign

Key Takeaways

• The U.S. Department of Justice has charged 17 individuals associated with the Iran-based Mabna Institute for a widespread cyber espionage campaign.
• The operation allegedly stole over 31.5 terabytes of academic research and intellectual property from hundreds of universities and various organizations globally.
• Victims included 144 U.S. universities, 178 international universities, numerous private companies, and government agencies, including the U.S. Department of Labor.
• The accused group allegedly worked on behalf of Iranian government entities, including the Islamic Revolutionary Guard Corps (IRGC), and monetized stolen data through illicit websites.

The U.S. Department of Justice (DOJ) has unsealed a comprehensive 14-count superseding indictment against 17 individuals, all reportedly affiliated with the Mabna Institute, an Iran-based organization. These charges stem from a prolonged cyber espionage campaign that allegedly resulted in the theft of at least 31.5 terabytes of sensitive research data and intellectual property.

According to the indictment, the sophisticated operation commenced around 2013 and persisted until at least December 2017. Prosecutors contend that the group operated under the direction of Iranian government and university clients, notably including the Islamic Revolutionary Guard Corps (IRGC).

The cyber campaign systematically targeted a diverse array of entities, encompassing universities, private corporations, governmental bodies, and non-governmental organizations across the United States and other nations.

The Mabna Institute was reportedly founded by Gholamreza Rafatnejad and Ehsan Mohammadi with the stated objective of facilitating Iranian institutions’ access to foreign scientific resources.

DOJ Charges 17 Iranian Hackers

The indictment describes the Mabna Institute as employing or collaborating with “hackers-for-hire” who executed a range of malicious activities. These included sophisticated phishing attacks, reconnaissance efforts, credential theft, password spraying, and extensive data exfiltration operations.

Widespread Academic Compromise

The group’s primary focus was academic institutions, where they targeted more than 100,000 professor accounts worldwide. This led to the alleged compromise of approximately 8,000 academic email accounts. The victims included 144 U.S. universities and 178 universities situated outside the United States.

Affected educational institutions spanned multiple continents, including Australia, Canada, China, Europe, the Middle East, Asia, and the United Kingdom. The attackers predominantly employed spearphishing emails to illicitly obtain professor login credentials.

Once access was gained to university networks and online library portals, the perpetrators exploited these vulnerabilities to access a vast trove of academic resources. This included academic journals, dissertations, theses, electronic books, research papers, and other protected materials. The stolen data encompassed a wide range of fields, such as scientific, engineering, medical, social science, technology, and various professional research areas.

The stolen intellectual property was subsequently exfiltrated to infrastructure controlled by the alleged conspirators located outside the United States. Prosecutors estimate that U.S. universities alone had invested over $3.4 billion to acquire access to the research and intellectual property that became targets of this campaign.

Monetization of Stolen Data

Beyond direct theft, the operation also allegedly leveraged stolen academic access for financial gain. Two Iran-based websites, Megapaper.ir and Gigapaper.ir, were reportedly utilized to sell the purloined resources and access to compromised university accounts.

Megapaper allegedly facilitated the sale of stolen academic content directly to customers within Iran. Concurrently, Gigapaper offered buyers direct access to online university library systems by exploiting hijacked professor accounts.

Broader Impact Beyond Academia

The indictment further reveals that the Mabna Institute’s operators extended their targeting beyond academia. They allegedly compromised at least 42 U.S. private-sector companies, 11 foreign companies, five U.S. federal and state government agencies, and several international organizations.

Among the named victims were prominent entities such as the U.S. Department of Labor, the Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations, and UNICEF.

This expanded indictment adds eight new defendants to a case initially announced in 2018. Several of the defendants are also purportedly linked to the 2017 intrusion into HBO, where stolen data was used in an attempted extortion scheme seeking approximately $6 million in Bitcoin.

The charges levied against the accused include conspiracy to commit computer intrusions, wire fraud, unauthorized access for private financial gain, and aggravated identity theft.

The DOJ said that the intrusions into some private-sector and government entities alone incurred over $20 million in investigation and remediation costs for the victims.

The State Department’s Rewards for Justice program is currently offering a reward of up to $10 million for information that leads to the location of five specific defendants: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh. It is important to note that the indictment represents an allegation, and all defendants are presumed innocent until proven guilty in a court of law.

What You Should Do

• Implement robust multi-factor authentication (MFA) for all accounts, especially for academic and high-privilege users.
• Conduct regular cybersecurity awareness training for all staff and students, emphasizing the dangers of phishing and social engineering.
• Patch and update all systems and software diligently to protect against known vulnerabilities.
• Monitor network traffic for unusual activity, especially large data exfiltration, and implement intrusion detection/prevention systems.
• Review and strengthen access controls to sensitive research data and intellectual property.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.