Press play to start listening
US prosecutors have charged 17 Iranian hackers with participating in a years-long hacking campaign that allegedly stole approximately 31.5 terabytes of academic research and intellectual property from universities worldwide.
The 14-count superseding indictment, unsealed on August 18, names alleged members and associates of the Mabna Institute, an Iran-based company accused of conducting hacking operations for the Islamic Revolutionary Guard Corps, Iranian universities and other clients.
Nine defendants were originally charged in March 2018. The expanded case adds eight people and connects the institute to further attacks against universities, businesses, government bodies and international organizations.
Thousands of Academic Accounts Compromised
Beginning around 2013, the group allegedly targeted more than 100,000 professor accounts with spearphishing emails designed to steal university login credentials. Prosecutors say approximately 8,000 accounts were compromised at 144 US universities and 178 institutions in 21 other countries, including the United Kingdom, Canada, Australia, Germany, Israel, Japan and South Korea.
After gaining access, the hackers allegedly downloaded journals, dissertations, electronic books and research covering engineering, medicine, science, social sciences and other fields. The Justice Department said US universities had spent more than $3.4 billion to obtain and access the types of academic material targeted in the campaign.
Some of that information, as per authorities, was then sold inside Iran. Prosecutors allege that Megapaper.ir offered stolen academic resources, while Gigapaper.ir allowed paying customers to use compromised professor accounts to enter university library systems directly.
Companies and Government Agencies Also Targeted
The campaign targeted other institutions as well. The defendants allegedly compromised employee email accounts belonging to at least 42 US companies, 11 foreign companies, five US federal or state agencies and two non-governmental organizations.
According to the DOJ’s press release, named targets included the US Department of Labor, Federal Energy Regulatory Commission, the states of Hawaii and Indiana, the United Nations and UNICEF. Additionally, three defendants involved in attacks against companies and government entities allegedly caused more than $20 million in investigation and remediation costs.
Several of the newly detailed defendants were also connected to the breach of HBO. Prosecutors say they helped steal proprietary information from the entertainment company before demanding approximately $6 million in Bitcoin.
US Offers $10 Million Reward
The indictment includes charges involving computer intrusions, wire fraud, aggravated identity theft and related conspiracies. Some wire fraud counts carry maximum prison sentences of 20 years, while aggravated identity theft carries a mandatory two-year sentence following conviction.
A parallel Rewards for Justice announcement offers up to $10 million for information leading to the location of Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz and Saber Shahbazi Ballojeh. The five are accused of acting under the direction or control of a foreign government while conducting malicious cyber activity.
The case remains at the indictment stage, and the Justice Department did not announce any arrests. All 17 defendants are presumed innocent unless proven guilty in court.
