Justice Department Charges 17 Iranians in Yearslong Hack of U.S. Universities That Stole 31.5 TB of Research

The Justice Department on Tuesday unsealed a superseding indictment charging 17 Iranians tied to the Mabna Institute in what prosecutors describe as a yearslong, state-linked hacking campaign that penetrated 144 U.S. universities and stole about 31.5 terabytes of academic data and intellectual property. Federal prosecutors in Manhattan allege many of the intrusions were carried out on behalf of Iran’s Islamic Revolutionary Guard Corps, or IRGC, as well as other Iranian government and university clients.

According to the Justice Department, the campaign began around 2013 and continued through at least December 2017. Prosecutors allege the defendants targeted more than 100,000 professor accounts worldwide and successfully compromised about 8,000 professor email accounts. Beyond universities, the indictment alleges the group also targeted at least 42 U.S. private-sector companies, 11 foreign companies, five U.S. federal and state government agencies, and two nongovernmental organizations. The stolen material allegedly included journals, theses, dissertations, e-books and research data, which prosecutors say were exfiltrated to servers outside the United States. The department also alleges the operation stole email accounts from government and private-sector victims and left some victims with more than $20 million in investigation and remediation costs.

The filing broadens a case the U.S. first brought in March 2018, when nine Iranians affiliated with the Mabna Institute were charged and related sanctions were announced. The new 14-count superseding indictment adds eight defendants, bringing the total to 17. The State Department’s Rewards for Justice program is also offering up to $10 million for information leading to the location of five defendants: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz and Saber Shahbazi Ballojeh.

Mesri is the most recognizable name in the case for many readers. The Justice Department said he was separately charged in 2017 in the hack and extortion case involving HBO, the television network behind series including “Game of Thrones.”

The case underscores how heavily the alleged operation focused on academia as a target. Prosecutors say the defendants sought access not only to university systems but also to scholars’ accounts and research databases, turning a cybercrime case into a broader national-security matter involving the theft of research and other intellectual property. “These defendants allegedly built and profited from a sprawling hacking-for-hire operation …,” Brett Leatherman, assistant director of the FBI’s Cyber Division, said in the Justice Department’s announcement. Assistant Attorney General for National Security John A. Eisenberg said the department “is committed to protecting the United States from such predators and will pursue those who perpetrate such crimes for as long as it takes to bring them to justice.”

The indictment, announced by the Justice Department’s Office of Public Affairs, contains allegations, and the defendants are presumed innocent unless proven guilty in court.