US Charges 17 in Iran Academic Hack, $10M Bounties

The U.S. Justice Department has unsealed charges against 17 individuals tied to an Iran-based hacking group, accusing them of breaking into hundreds of universities and other organizations worldwide. The indictment, filed this week, details a years-long operation that siphoned off academic data and intellectual property on a global scale. Alongside the charges, the State Department is offering rewards of up to $10 million for information leading to the arrest of five of the accused.

Charges Target Mabna Institute

The defendants are linked to Mabna Institute, a company founded in 2013, according to the superseding indictment. U.S. prosecutors say the group was created to help universities and research organizations in Iran steal non-Iranian scientific resources. The 14-count indictment alleges the defendants acted on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC).

The scope of the alleged intrusions is wide. The indictment claims Mabna targeted 144 universities in the U.S. and 178 abroad, as well as 42 private companies in the U.S. and 11 overseas, five U.S. government agencies, and at least two non-governmental organizations. The stolen data reportedly includes over 31 terabytes of academic data and intellectual property, along with employee email accounts.

Key Defendants and Alleged Roles

The indictment names Gholamreza Rafatnejad and Ehsan Mohammadi as the founders of Mabna Institute. The other defendants are listed as Abdollah Karima (aka Vahid Karima), Mostafa Sadeghi, Seyed Ali Mirkarmi, Mohammed Reza Sabahi, Roozbeh Sabahi, Abuzar Gohari Moqadam, Sajjad Tahmasebi, Saeid Houshyar, Behzad Mesri (aka Skote Vahshat), Manouchehr Hashemloo, Keyvan Fayaz (aka Achilles, The Joker, and bc.monster), Amir Barati, Saber Shahbazi Ballojeh, Arman Kahzadian, and Mojtaba Galekuhi (aka Mojtaba Ghaleh Koui).

The Justice Department says the Mabna Institute conducted cyber intrusions on behalf of both the Iranian government and private organizations. The indictment alleges that the stolen data was sold through two companies, Megapaper and Gigapaper, which were affiliated with defendant Abdollah Karima.

Rewards for Justice Offers

Through the Rewards for Justice program, the U.S. government is offering rewards of up to $10 million for information leading to the arrest of Mesri, Galekuhi, Kahzadian, Fayaz, and Ballojeh. The program is designed to encourage insiders or others with knowledge of the defendants' whereabouts to come forward.

These rewards are part of a broader U.S. effort to bring Iranian hackers to justice, though extradition from Iran is unlikely. The rewards may also help U.S. authorities track down the individuals if they travel outside Iran.

Scale of the Academic Hack

The indictment provides a detailed picture of the campaign's reach. It says the defendants targeted over 100,000 professors worldwide and successfully compromised roughly 8,000 professor email accounts at 144 universities in the U.S. and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, the Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and other countries.

• 144 universities in the U.S. and 178 abroad targeted
• 42 private companies in the U.S. and 11 abroad targeted
• 5 U.S. government agencies targeted
• Over 31 terabytes of data stolen
• Over 100,000 professors targeted, ~8,000 accounts compromised
• Up to $10 million rewards offered for five defendants

Extortion of HBO

The defendants also allegedly targeted various private and government agencies, including HBO, in a $6 million extortion attempt. This incident highlights the financial motivations behind some of these intrusions, beyond just data theft for academic advantage.

The indictment does not provide further details on the HBO case, but it ties the defendants to a broader pattern of cybercrime that includes both espionage and extortion.

Legal and Enforcement Context

The charges come amid a broader U.S. crackdown on Iranian cyber activities. In recent years, the Department of Justice has secured guilty pleas and sentences in other high-profile cases, including the Snowflake hacker and a Belarusian ransomware mastermind, both of whom faced justice in U.S. courts. These cases show a pattern of U.S. prosecutors aggressively pursuing cybercriminals, even those acting on behalf of foreign states.

However, the practical effect of this indictment depends on whether the U.S. can actually bring the defendants to court. The rewards offered may yield results, but the absence of extradition agreements with Iran means the defendants are unlikely to face trial soon.

What This Means for Institutions

For universities and private companies, this case is a reminder that state-sponsored actors see academic and corporate research as valuable targets. The scale of the Mabna operation — 31 terabytes of data, thousands of compromised accounts, and a global footprint — shows how vulnerable such institutions are to sophisticated espionage.

This could mean that institutions need to reassess their threat models and invest more in protecting their most valuable asset: their intellectual property. The use of the Rewards for Justice program also suggests that U.S. authorities are willing to use financial incentives to track down hackers, which could deter some individuals from participating in such operations.