US Justice Department Charges 17 Iranians With Massive IRGC-Directed Cyber Theft Campaign
Mabna Institute hackers stole more than 31 terabytes of academic data and intellectual property since 2013, selling stolen research through Iranian websites, while the State Department offers $10 million for five fugitives
ERBIL (Kurdistan 24) - The United States Department of Justice unsealed a 14-count superseding indictment on Tuesday charging 17 Iranian nationals with conducting a massive and sustained cyber theft campaign on behalf of the Islamic Revolutionary Guard Corps and other Iranian government entities, expanding a case originally brought in 2018 to add eight new defendants and detail the full scope of one of the largest state-directed cyber espionage operations ever prosecuted in an American court.
The Justice Department confirmed on Tuesday that the 17 defendants are members of the Mabna Institute. This Iran-based company since at least 2013 has conducted coordinated cyber intrusions into the computer systems of 144 US universities, 178 foreign universities, at least 42 US private sector companies, at least 11 foreign private sector companies, at least five US federal and state government agencies, and at least two non-governmental organizations, according to the official DOJ press release published on the Justice Department's website on August 18, 2026.
The campaign generated more than 31 terabytes of stolen data, prosecutors said, encompassing academic research, intellectual property, proprietary business data, and government records that the defendants then sold or provided to Iranian universities and government clients who could not obtain the material through legitimate means, as the DOJ confirmed on Tuesday.
A Commercial Cyber Theft Operation
As IBTimes UK reported on Tuesday, beyond providing stolen material directly to Iranian government and university clients, the Mabna Institute turned the theft into a commercial operation. Stolen research and login credentials were sold through two Iran-based websites, Megapaper.ir and Gigapaper.ir, making the operation simultaneously a state intelligence programme and a revenue-generating criminal enterprise.
As the Epoch Times confirmed on Tuesday, the 17 named defendants are Gholamreza Rafatnejad, Ehsan Mohammadi, Abdollah Karima, Mostafa Sadeghi, Seyed Ali Mirkarimi, Mohammed Reza Sabahi, Roozbeh Sabahi, Abuzar Gohari Moqadam, Sajjad Tahmasebi, Saeid Houshyar, Behzad Mesri, Manouchehr Hashemloo, Keyvan Fayaz, Amir Barati, Saber Shahbazi Ballojeh, Arman Kahzadian, and Mojtaba Galekuhi. Nine of the 17 were previously charged in the original 2018 seven-count indictment. Tuesday's superseding indictment adds eight new defendants and describes additional cyberattacks against American and international institutions that had not been detailed in the original case.
The defendants face charges including conspiracy to commit computer intrusions, conspiracy to commit wire fraud, unauthorized computer access, aggravated identity theft, and wire fraud, as JNS confirmed on Tuesday.
$10 Million Reward for Five Fugitives
As IBTimes UK reported on Tuesday, the State Department's Rewards for Justice programme is offering up to $10 million for information leading to the location of five defendants who remain at large: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh. The offer reflects Washington's assessment that these five individuals represent the most significant unresolved fugitive exposure from the Mabna Institute operation.
Official Statements
"The superseding indictment alleges that, at the behest of entities including the IRGC, these defendants hacked into universities and other research institutions worldwide, including the United States, stealing at least 31 terabytes of information and intellectual property of untold value," Assistant Attorney General for National Security John A. Eisenberg said, as the DOJ confirmed on Tuesday. US Attorney Jamie McDonald added: "Today's charges show that neither sophistication nor geographic boundaries will deter us from protecting the national security of our country from those who target the United States from abroad."
As the Washington Examiner reported on Tuesday, FBI Deputy Director Barnacle stated: "Their campaign stole vast amounts of intellectual property and sensitive information, reinforcing the FBI's commitment to confront this activity head-on. Backed by the IRGC, this operation reflects a broader, organized effort to target US institutions."
The Broader Context
The unsealing of the indictment on Tuesday arrives on a day dominated by a sweeping escalation of American pressure against Iran across multiple domains. The UAE announced the halting of all trade, commercial, and financial transactions with Iran. Saudi Arabia, Qatar, and Kuwait all issued formal condemnations of the drone strike on KRG Prime Minister Masrour Barzani's office. The Justice Department's cyber charges add a legal and intelligence dimension to a pressure campaign that has simultaneously targeted Iran's financial networks, military capabilities, and now its state-directed hacking infrastructure.
The case is being heard in the Southern District of New York, with the UK's National Crime Agency credited as an investigative partner, as IBTimes UK confirmed on Tuesday.