The U.S. Department of Justice on Tuesday announced indictments against 17 members of the Mabna Institute, an Iranian organization alleged to be behind a coordinated cyberattack campaign on behalf of the Islamic Revolutionary Guard Corps.
Federal prosecutors said the group allegedly hacked into 144 U.S.-based universities, 42 U.S.-based private sector companies and at least five federal and state agencies, as well as a large number of foreign universities and companies, since 2013.
The charges reveal a broader effort behind a “sweeping state-sponsored campaign to steal research and intellectual property from American universities, businesses and government institutions,” Jamie McDonald, U.S. Attorney for the Southern District of New York, said in a statement.
Prosecutors allege more than 100,000 accounts of professors were targeted by the alleged hackers, and 8,000 of those accounts were successfully compromised.
In all, the attackers stole more than 31TB of academic data and intellectual property from various universities and broke into employee email accounts at universities, private companies and government agencies.
The charges are part of a superseding indictment that originated against the Mabna Institute eight years ago. Nine of the 17 defendants were part of a seven-count indictment unsealed in the 2018 case.
Mabna has been tracked for years under the names Silent Librarian, Cobalt Dickens or TA407. Researchers at Sophos and Proofpoint linked the group to years of social engineering and phishing activity, often using stolen university branding or library-themed phishing emails.
“Mabna represents the privatization of state espionage: a contractor selling stolen research to whoever's paying, with the IRGC as an anchor client rather than a sole owner,” Shmuel Gihon, security research team lead, exposure management at Check Point Software, told Cybersecurity Dive.
The defendants previously targeted various government agencies, including the U.S. Department of Labor and Federal Energy Regulatory Commission, the states of Hawaii and Indiana, as well as the United Nations, according to the DOJ.
The defendants also targeted Home Box Office in the hacking campaign. One of the defendants, Behzad Mesri, was charged in 2017 with attempting to extort the company for $6 million in bitcoin in connection with the hack of unaired episodes of the HBO series “Game of Thrones.”
Iran war rages on
The charges come amid an investigation into a coordinated hack of water systems in 12 U.S. states. No charges have been filed in that case, but federal and state investigators linked the incidents to recent cyberattacks targeting industrial devices that monitor water systems.
The U.S. has been at war with Iran since launching a bombing campaign with Israel in late February.
The State Department is offering a $10 million reward for information leading to the location of five of the defendants, including Mesri.
