The US Department of Justice has charged 17 alleged members of Iran's Mabna Institute in a superseding indictment covering a years-long hacking-for-hire campaign that included a roughly $6 million Bitcoin extortion demand against HBO and the theft of an estimated 31.5 terabytes of academic data from universities around the world.
Six of the defendants are tied directly to the 2017 breach of HBO, in which the network was allegedly threatened with the release of stolen scripts and unaired episodes unless it paid roughly $6 million in Bitcoin. Those six — Behzad Mesri, Saeid Houshyar, Manouchehr Hashemloo, Keyvan Fayaz, Saber Shahbazi Ballojeh and Arman Kahzadian — join defendants first charged in 2018 for a separate, far larger campaign against academic institutions.
Prosecutors say the group targeted more than 100,000 professor accounts worldwide through spearphishing and stolen credentials, successfully compromising roughly 8,000 of them across 144 US universities and 178 foreign institutions. The stolen material — research papers, dissertations, journals and ebooks — was allegedly funneled back to Iranian universities and, according to the DOJ, to the Islamic Revolutionary Guard Corps and other Iranian government entities that paid for the access.
A Case Nearly a Decade in the Making
The Mabna Institute was founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, ostensibly to help Iranian universities and research organizations obtain access to scientific resources they couldn't otherwise reach. Nine of the 17 now-charged defendants were first indicted back in 2018 over a campaign that, at the time, was already described as touching nearly 8,000 professor accounts at 320 universities. This week's superseding indictment folds in the HBO extortion case and eight additional defendants, more than eight years after the underlying conduct began.
FBI Cyber Division Assistant Director Brett Leatherman said the defendants “allegedly built and profited from a sprawling hacking-for-hire operation,” while Assistant Attorney General John A. Eisenberg said the charges were brought “at the behest of entities including the IRGC.” US Attorney Jamie McDonald added that “the passage of time will not deter us” from pursuing hackers operating outside US reach.
Related: Kraken Account Freezes Tied to HTX Wallet Spark Dispute Over 'Poisoning' Claims
Bitcoin's Recurring Role in State-Linked Extortion
The HBO case is one of a long line of nation-state-linked hacking operations that have leaned on Bitcoin specifically for its ability to move value across borders without a bank intermediary, even though blockchain analytics firms have gotten considerably better at tracing those flows after the fact. The Justice Department's announcement notes that most of the defendants remain outside US custody, and the State Department is now offering rewards of up to $10 million for information leading to the location of five of them.
Because none of the newly named defendants are in US custody, the case is likely to remain largely symbolic in the near term — a marker of intent rather than an imminent prosecution — unless one of the accused travels to a country with an extradition arrangement with Washington.
