Key Takeaways
Federal prosecutors in Manhattan unsealed a 14-count superseding indictment Tuesday charging 17 members of Iran's Mabna Institute, adding eight defendants to a case first brought against nine in 2018.
The alleged campaign compromised about 8,000 professor accounts across 144 US universities and 178 foreign ones, plus 42 US companies, five federal and state agencies, and the United Nations and UNICEF.
Prosecutors say the defendants stole at least 31.5 terabytes of academic data and resold it inside Iran through two websites, Megapaper and Gigapaper.
The Mabna Institute was founded in about 2013 for the express purpose of getting Iranian universities access to non-Iranian scientific research, according to the indictment unsealed by the US Attorney's Office for the Southern District of New York. It hired contract hackers, ran spearphishing campaigns against more than 100,000 professors around the world, and did the university work on behalf of the Islamic Revolutionary Guard Corps. US universities had spent roughly $3.4 billion procuring the data that was taken.
The resale layer is the part that stands out. Megapaper sold stolen academic resources to Iranian public universities and institutions. Gigapaper sold Iranian customers a service that let them log in with compromised professor accounts and browse the library systems of real US and foreign universities directly. Research theft ran as a subscription business.
What the Eight New Defendants Add
The superseding indictment extends the timeline past the original campaign. Prosecutors allege the group hacked HBO and tried to extort roughly $6 million in bitcoin, and that password spray attacks on private companies and at least two government entities cost victims more than $20 million to investigate and remediate. Named victims include the Department of Labor, the Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations and UNICEF. The State Department is offering up to $10 million for information locating five of the defendants, all of whom are believed to be in Iran and none of whom are in custody.
"Cyber operations have become a central instrument of national power," said US Attorney Jamie McDonald. That framing lands differently in the middle of an active confrontation. WYDE has covered Iran-linked intrusions into US water systems across seven states and the collapse of the 60-day US-Iran memorandum over the Strait of Hormuz. The charges are allegations, and the defendants are presumed innocent. The Hill reported the unsealing.
People Also Ask
What is the Mabna Institute?
An Iran-based company founded around 2013 that prosecutors say existed to steal foreign scientific research and intellectual property for Iranian universities and government clients, using hackers-for-hire.
How much data was stolen?
At least 31.5 terabytes of academic data and intellectual property, exfiltrated to servers outside the United States controlled by members of the conspiracy.
Which institutions were targeted?
144 US universities and 178 foreign universities, at least 42 US and 11 foreign companies, five federal and state government agencies, and two non-governmental organizations including the United Nations and UNICEF.
Are any of the defendants in custody?
No. The State Department's Rewards for Justice program is offering up to $10 million for information leading to the location of five of them. Charges carry maximum sentences of up to 20 years on the wire fraud counts.