US Charges 17 Iranians Over Alleged Massive Cyber-Theft Campaign

The United States has charged 17 Iranians over an alleged massive cyber-theft campaign targeting hundreds of universities, companies, government agencies and other organisations worldwide.

The US Department of Justice said Tuesday that a 14-count superseding indictment had been unsealed against members of the Mabna Institute, an Iran-based company accused of conducting coordinated cyber intrusions since at least 2013.

According to the indictment, the defendants targeted 144 US-based universities, 178 foreign universities, at least 42 US-based private companies, 11 foreign companies, five US federal and state government agencies and at least two non-governmental organisations.

The Justice Department said the hackers stole at least 31.5 terabytes of academic data and intellectual property, as well as employee email accounts from private companies, government agencies and NGOs.

It alleged that many of the cyber intrusions were conducted on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC) and other Iranian government and university clients.

Nine of the 17 defendants were previously charged in a seven-count indictment announced in March 2018, while Tuesday’s superseding indictment adds eight defendants to the case.

The Mabna Institute was founded in about 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, according to the Justice Department, which said the organisation assisted Iranian universities and research institutions in obtaining unauthorised access to scientific resources outside Iran.

The defendants allegedly targeted more than 100,000 university professor accounts globally and successfully compromised about 8,000 accounts across the 322 universities identified in the indictment.

The campaign, which began around 2013 and continued through at least December 2017, targeted academic research and intellectual property across fields including science and technology, engineering, social sciences and medicine.

The Justice Department said the stolen academic resources included journals, theses, dissertations and electronic books, while some of the stolen material was allegedly sold through websites operated or affiliated with members of the conspiracy.

Beyond universities, the defendants allegedly compromised employee email accounts at at least 42 US companies, 11 foreign companies and several government and non-governmental organisations, including the US Department of Labor, the Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations and the United Nations Children’s Fund.

The superseding indictment also alleges that members of the group targeted HBO and were involved in hacking private companies and government entities, causing victims to incur more than $20m in investigation and remediation costs.

The US Department of State’s Rewards for Justice programme is offering up to $10m for information leading to the location of five of the defendants, including Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz and Saber Shahbazi Ballojeh.

Assistant Attorney General for National Security John Eisenberg said the defendants allegedly hacked universities and research institutions worldwide at the behest of entities including the IRGC, stealing large volumes of information and intellectual property.

The Federal Bureau of Investigation (FBI) also said the defendants allegedly operated a “hacking-for-hire” network targeting intellectual property belonging to American and allied universities, companies and government agencies for the benefit of the Iranian government.

The US authorities stressed that an indictment is merely an allegation and that all defendants are presumed innocent until proven guilty beyond a reasonable doubt.

The case is assigned to US District Judge Jesse M. Furman in the Southern District of New York.