US Charges 17 Iranians for Global Cyberattacks on Universities and Corporations

The US Department of Justice has indicted 17 Iranians accused of running a global hacking operation on behalf of Iran's Revolutionary Guards and other entities. The defendants, linked to Tehran's Mabna Institute, allegedly breached around 8,000 academic accounts belonging to faculty at 144 US universities and 178 institutions worldwide, including in Israel. They stole over 31 terabytes of data, comprising research, books, academic papers, and intellectual property. More than 100,000 academic accounts globally were targeted, though details about Israeli universities and affected accounts remain confidential.

The hackers also infiltrated email accounts of employees at 42 American companies, 11 European firms, and various government and international organizations such as the US Department of Labor, the United Nations, and UNICEF. Mabna Institute reportedly operated as an organized hacking service provider, working for Iranian government bodies and private clients for payment. Their tactics included identifying targets, phishing, stealing passwords, and transferring stolen data to controlled servers.

Among the victims was HBO, from which scripts and materials related to "Game of Thrones" were stolen. The hackers demanded $6 million in Bitcoin from HBO and released some content online after nonpayment. The operation involved impersonating researchers to trick academics into entering credentials on fake login pages, enabling access to their accounts and academic databases.

US universities reportedly spent about $3.4 billion on acquiring materials and database access from which data was stolen. The FBI estimates the stolen data volume was three times larger than the entire print collection of the Library of Congress. The case, first uncovered in 2018, now includes 14 charges against 17 suspects, including conspiracy to commit computer intrusion, fraud, aggravated identity theft, and extortion. The US State Department offers up to $10 million for information leading to the capture of five suspects. Amir Barati, one defendant, was arrested in Montenegro in June, with the US seeking his extradition. An FBI cyber division official emphasized the indictment signals that the agency's memory is long and that time will not deter ongoing pursuit of such actors.