The United States has announced criminal charges against 17 people connected to the Iran-based Mabna Institute, alleging large-scale hacking against hundreds of organizations in the US and abroad. In addition to the charges, the Justice Department says the government is prepared to pay as much as $10 million for information that leads to the arrest of specific defendants.
According to a 14-count superseding indictment, the alleged activity includes targeting universities, private companies, government bodies, and at least two non-governmental organizations, alongside theft of academic data, intellectual property, and employee email accounts.
What the US alleges about Mabna Institute
Prosecutors say Mabna Institute was founded in 2013 with the goal of helping universities and research organizations in Iran steal scientific resources that originated outside Iran. The indictment describes intrusions affecting 144 US universities and 178 institutions internationally, alongside additional victims in industry and government.
Among the alleged targets are private companies in the US, government agencies, and organizations outside the US as well. The government’s figures point to more than 31 terabytes of academic data and intellectual property allegedly taken during the intrusions, as well as compromises of employee email accounts.
The Justice Department further claims that the defendants acted on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC), according to the indictment.
Scale and targets: universities, email accounts, and research data
One of the most striking parts of the indictment is the claimed reach of the operation across global academic communities. Prosecutors state the defendants targeted over 100,000 professors worldwide.
In the US alone, the indictment alleges roughly 8,000 professor email accounts were compromised across 144 universities. Internationally, it says the same kind of access extended to 178 institutions across countries including Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, the Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and others.
Prosecutors allege that once attackers obtained access using stolen credentials, they used the compromised accounts to exfiltrate data and documents. The indictment describes theft across multiple disciplines, including engineering, medical research, technology, and other research areas.
Who is accused in the indictment
The superseding indictment names 17 defendants. Prosecutors allege that Mabna Institute was founded by Gholamreza Rafatnejad and Ehsan Mohammadi.
The indictment also describes relationships involving several additional individuals, including Abdollah Karima (also known as Vahid Karima), and others named as acting, contracting, or being affiliated with the alleged operation. Among the listed defendants are:
- Mostafa Sadeghi
- Seyed Ali Mirkarmi
- Mohammed Reza Sabahi
- Roozbeh Sabahi
- Abuzar Gohari Moqadam
- Sajjad Tahmasebi
- Saeid Houshyar
- Behzad Mesri (also known as Skote Vahshat)
- Manouchehr Hashemloo
- Keyvan Fayaz (also known as Achilles, The Joker, and bc.monster)
- Amir Barati
- Saber Shahbazi Ballojeh
- Arman Kahzadian
- Mojtaba Galekuhi (also known as Mojtaba Ghaleh Koui)
It is alleged that the group carried out intrusions on behalf of both the Iranian government and private entities.
Up to $10 million in rewards for key arrests
Beyond the criminal case itself, the US is attempting to accelerate identification and apprehension. Through the Rewards for Justice program (RFJ), prosecutors say the government offers rewards of up to $10 million for information leading to the arrest of five individuals.
Those named for potential 10M rewards offered include Mesri, Galekuhi, Kahzadian, Fayaz, and Ballojeh.
The announcement emphasizes that tips and information that materially contribute to arrests can qualify the information provider for the reward amount described in the program.
Alleged data sales and additional criminal behavior
Prosecutors do not limit the allegations to stealing data from academic accounts. The superseding indictment also claims that stolen information was sold through two companies connected to Abdollah Karima: Megapaper and Gigapaper.
In addition, the indictment alleges targeted activity against other organizations. One example mentioned is a reported extortion attempt involving HBO, which prosecutors describe as a $6 million effort.
Why this case matters for institutions
This case highlights a recurring pattern in large-scale intrusions: access to email accounts can be used not only to steal files, but also to broaden impact by leveraging trust in a user’s identity. When professor accounts are compromised, attackers may obtain a foothold across research collaborations, ongoing projects, and shared communications.
For universities, research centers, and private organizations, the allegations underline the importance of protecting credential security, monitoring for unusual sign-in activity, and ensuring that sensitive research data is protected even if a user’s mailbox is compromised.
The indictment also points to extensive international reach, suggesting that defenders should consider how authentication and monitoring practices hold up across time zones, travel, and global collaboration.
Next steps in the US case
With the charges announced and the superseding indictment issued, the focus for investigators and prosecutors appears to be twofold: pursue accountability in court and encourage information that can lead to arrests. The Rewards for Justice offer of up to $10 million is designed to incentivize information about specific defendants.
As the case develops, organizations facing similar threats may want to review whether their email security and credential protections adequately reduce the risk of account takeover and downstream data exfiltration.
Conclusion
The US claims that 17 people linked to Mabna Institute participated in cyber intrusions targeting universities and organizations across many countries. The indictment alleges large-scale theft of academic data, intellectual property, and professor email accounts, while also describing claims of data sales through affiliated companies and other malicious activity.
At the same time, the Justice Department is pushing for arrests by offering $10 million rewards under the Rewards for Justice program—an effort captured in the announcement as 10M rewards offered for information leading to key apprehensions.
Source: https://www.securityweek.com/us-charges-17-iranian-hackers-offers-10-million-rewards-for-5-of-them/
