The U.S. Department of Justice unsealed an indictment charging 17 alleged Iranian hackers tied to the Mabna Institute with a years-long campaign of cyber intrusions targeting universities, private companies, government agencies, and NGOs, and investigators say the campaign acted at the direction of Iran’s Islamic Revolutionary Guard Corps.
The announcement lays out an extensive, coordinated theft of research, academic data, and intellectual property that authorities say stretches back to at least 2013. The accused are charged with breaching hundreds of institutions across the U.S. and many other countries, extracting massive volumes of data. That scale raises questions about how foreign intelligence services are using cyber operations to advance national objectives.
https://x.com/SDNYnews/status/2089774057164046771?ref_src=twsrc%5Etfw
The government alleges that the Mabna Institute siphoned off terabytes of sensitive material from universities and companies, then used that material to support Iranian state interests. If true, the operation reads like intelligence tradecraft applied at industrial scale: persistent intrusion, broad targeting, and significant exfiltration. The indictment is meant to expose the campaign and tie the work back to Iranian entities, including the IRGC.
The X post reads:
17 Iranians charged with conducting massive cyber theft campaign on behalf of the IRGC and other Iranian entities: the Mabna Institute hackers attacked systems belonging to hundreds of universities, companies, and other victims to steal research, academic and proprietary data, and intellectual property.
The official charging document, according to prosecutors, catalogs intrusions into 144 U.S.-based universities, 178 foreign universities, dozens of private U.S. companies, several foreign companies, multiple government agencies, and several NGOs. In total, the indictment claims the defendants stole more than 31 terabytes of data and intellectual property, plus employee email accounts from multiple sectors. Those are big numbers that signal sustained and organized activity.
United States Attorney for the Southern District of New York, Jamie McDonald, Assistant Attorney General for National Security, John A. Eisenberg, and Assistant Director in Charge of the New York Field Office of the Federal Bureau of Investigation (“FBI”), James C. Barnacle, Jr., announced today the unsealing of a 14-count Superseding (“S2”) Indictment charging 17 members of the Mabna Institute, an Iran-based company that, since at least 2013, conducted a coordinated campaign of cyber intrusions into computer systems to 144 U.S.-based universities, 178 foreign universities, at least 42 U.S.-based private sector companies, at least 11 foreign private sector companies, at least five U.S. federal and state government agencies, and at least two non-governmental organizations (“NGOs”). Through the defendants’ activities, the Mabna Institute stole more than 31 terabytes of academic data and intellectual property from universities, and the email accounts of employees at private sector companies, government agencies, and non-governmental organizations.
The scope isn’t limited to the United States: institutions and companies across Europe, Asia, Australia, and the Middle East were flagged as victims. The indictment lists targets in countries including Australia, Canada, China, Germany, Israel, Japan, South Korea, the United Kingdom, and many others. That geographic spread underscores how state-directed cyber campaigns can reach across borders and hit allies and competitors alike.
Prosecutors explicitly point to the IRGC as a beneficiary and, in some instances, a client of the alleged intrusions. The IRGC remains one of Iran’s most capable and aggressive instruments of foreign policy and intelligence collection. If the alleged ties hold up, the case will reinforce concerns that Tehran leverages commercial or quasi-commercial cyber firms to carry out offensive espionage.
Through the defendants’ activities, the Mabna Institute stole more than 31 terabytes of academic data and intellectual property from universities, and the email accounts of employees at private sector companies, government agencies, and non-governmental organizations. The defendants conducted many of these intrusions on behalf of the Islamic Republic of Iran’s (“Iran”) Islamic Revolutionary Guard Corps (“IRGC”), one of several entities within the government of Iran responsible for gathering intelligence, as well as other Iranian government and university clients.
One immediate question is practical: where are the defendants now, and can the U.S. actually bring them to justice? The Mabna Institute is based in Tehran, and there has been no public sign that Iran will extradite personnel to face U.S. charges. That leaves the indictment as a public accounting of alleged activity and a legal tool should suspects travel to jurisdictions willing to cooperate.
From a policy angle, the case revives familiar debates about retaliation, deterrence, and cyber norms. The indictment signals U.S. intent to name and shame, but critics argue that naming alone is not enough. A government that can respond in kind, or impose meaningful costs through sanctions and operations, will be in a stronger position to dissuade future attacks.
For organizations in academia, industry, and government, the indictment is a reminder that cyber defense is not optional. The alleged theft of research and proprietary work has real economic and security consequences, and defending intellectual property requires constant investment, better practices, and active cooperation between the public and private sectors. The case should sharpen focus on those vulnerabilities.
The criminal filing is now public and will be parsed by legal teams, cybersecurity experts, and policymakers alike as they weigh next steps. The Justice Department’s move to bring charges is one lever in a broader national effort to protect critical data and to hold foreign actors accountable when they cross legal lines.
Add comment