US indicts 17 Iranians over $20m cyber-theft campaign targeting 322 global institutions

US indicts 17 Iranians over $20m cyber-theft campaign targeting 322 global institutions

Justice Department Unseals 14-Count Superseding Indictment Alleging Massive Hacking Operation Conducted on Behalf of Iranian Government and IRGC

The United States has charged 17 Iranian nationals in connection with an alleged massive cyber-theft campaign that targeted hundreds of universities, private companies, government agencies, and non-governmental organisations across the globe. The US Department of Justice announced on Tuesday that a 14-count superseding indictment had been unsealed against members of the Mabna Institute, an Iran-based company accused of conducting coordinated cyber intrusions since at least 2013, according to multiple reports.

The indictment, which has been assigned to US District Judge Jesse M. Furman in the Southern District of New York, represents one of the most extensive cyber-related prosecutions ever brought against Iranian actors. Nine of the 17 defendants were previously charged in a seven-count indictment announced in March 2018, while Tuesday’s superseding indictment adds eight additional defendants to the case, expanding the scope of the alleged criminal enterprise.

Assistant Attorney General for National Security John Eisenberg stated that the defendants allegedly hacked universities and research institutions worldwide at the behest of entities including Iran’s Islamic Revolutionary Guard Corps (IRGC), stealing large volumes of information and intellectual property. The Federal Bureau of Investigation (FBI) also stated that the defendants allegedly operated a “hacking-for-hire” network targeting intellectual property belonging to American and allied universities, companies, and government agencies for the benefit of the Iranian government. The US authorities stressed that an indictment is merely an allegation and that all defendants are presumed innocent until proven guilty beyond a reasonable doubt.

READ ALSO:

• Police Nab 49-Year-Old With Pump-Action Rifle, 50 Ammunition Rounds In Anambra
• WMotors takes Jetour Africa Expedition to Lagos, Puts SUVs to Off-Road Test
• ‘No Electoral Agreement with ADC’ – Adeleke Rejects Collaboration Claims, Credits God

The alleged hacking campaign targeted a staggering number of victims globally, including 144 US-based universities and 178 foreign universities, totalling 322 academic institutions worldwide. The hackers are alleged to have targeted more than 100,000 university professor accounts globally and successfully compromised about 8,000 accounts across the identified universities. The campaign, which began around 2013 and continued through at least December 2017, targeted academic research and intellectual property across fields including science and technology, engineering, social sciences, and medicine.

The Justice Department said the hackers stole at least 31.5 terabytes of academic data and intellectual property, including journals, theses, dissertations, and electronic books. Some of the stolen material was allegedly sold through websites operated or affiliated with members of the conspiracy, transforming stolen academic resources into a profitable underground enterprise. Beyond universities, the defendants allegedly compromised employee email accounts at at least 42 US-based private companies, 11 foreign companies, and several government agencies and non-governmental organisations.

The alleged hacking campaign extended beyond academic institutions to include several high-profile government and non-governmental organisations. The Justice Department identified the following entities as among those targeted: the US Department of Labor, the Federal Energy Regulatory Commission (FERC), the states of Hawaii and Indiana, the United Nations, and the United Nations Children’s Fund (UNICEF). The superseding indictment also alleges that members of the group targeted HBO and were involved in hacking private companies and government entities, causing victims to incur more than $20 million in investigation and remediation costs.

A central element of the indictment is the alleged connection between the Mabna Institute and Iran’s Islamic Revolutionary Guard Corps (IRGC). The Justice Department alleged that many of the cyber intrusions were conducted on behalf of the IRGC and other Iranian government and university clients. The Mabna Institute was founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, according to the Justice Department. The organisation allegedly assisted Iranian universities and research institutions in obtaining unauthorised access to scientific resources outside Iran while also providing hacking services to Iranian government and private entities.

This mirrors actions taken by the US Treasury Department in March 2018, when it announced sanctions against the Mabna Institute and 10 individuals, stating that the group had been acting at the behest of the IRGC. The Treasury Department had also noted that one of the hackers involved had attempted to extort $6 million from a US media company and was previously indicted in November 2017, demonstrating a pattern of aggressive cyber-operations and financial extortion.

The US Department of State’s Rewards for Justice programme is offering up to $10 million for information leading to the location of five of the defendants: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh. This substantial reward reflects the seriousness with which US authorities view these alleged cyber-operations and their commitment to bringing the perpetrators to justice.

The case highlights the persistent challenge of state-sponsored cyber-operations and the ongoing efforts by US authorities to hold perpetrators accountable through legal and financial measures. With the charged individuals believed to be outside the United States and no extradition treaty with Iran, their apprehension remains uncertain. However, the US continues to pursue international cooperation and legal avenues to bring them to justice, signalling that such cyber-operations will not go unanswered.

US indicts 17 Iranians over $20m cyber-theft campaign targeting 322 global institutions