US charges 17 Iranians over ‘massive’ cyber theft campaign

The US has charged 17 Iranian nationals over an alleged state-sponsored cyber campaign that targeted hundreds of universities, companies and government bodies and stole more than 31 terabytes of academic data and intellectual property.

The defendants are accused of being members of the Mabna Institute, an Iran-based company that US prosecutors say has conducted cyber intrusions since at least 2013 on behalf of the Islamic Revolutionary Guard Corps (IRGC), other Iranian government bodies and university clients.

A 14-count superseding indictment unsealed in New York alleges that the operation targeted computer systems belonging to 144 universities in the US and 178 universities overseas.

At least 42 US private sector companies and 11 foreign companies were also targeted, along with at least five US federal and state government agencies and two non-governmental organisations.

Prosecutors allege that more than 31 terabytes of academic data and intellectual property were stolen from universities. The hackers are also accused of gaining access to email accounts belonging to employees of companies, government agencies and NGOs.

US authorities say many of the intrusions were carried out for the IRGC, one of the principal organisations responsible for intelligence gathering within the Iranian state.

John Eisenberg, Assistant Attorney General for National Security, said: “The superseding indictment alleges that, at the behest of entities including the IRGC, these defendants hacked into universities and other research institutions worldwide, including the United States, stealing at least 31 terabytes of information and intellectual property of untold value.”

“The National Security Division is committed to protecting the United States from such predators and will pursue those who perpetrate such crimes for as long as it takes to bring them to justice.”

Nine of the 17 defendants were originally charged in March 2018. The latest indictment adds eight defendants and, according to prosecutors, reveals a wider network allegedly involved in the operation.

Jamie McDonald, US Attorney for the Southern District of New York, described the alleged activity as a “sweeping, state-sponsored campaign” to steal research and intellectual property from American institutions.

“More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad. Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength. This office and our partners will continue to protect American innovation and pursue accountability for the individuals behind these attacks.”

The FBI described the Mabna Institute as an alleged hacking-for-hire operation that targeted intellectual property held by American and allied institutions for the benefit of Tehran.

“These defendants allegedly built and profited from a sprawling hacking-for-hire operation that targeted the intellectual property of American and allied universities, companies, and government agencies for the benefit of the Iranian government,” said Brett Leatherman, Assistant Director of the FBI’s Cyber Division.

“Today’s charges make clear to cyber adversaries everywhere: the FBI’s memory is long, and time will not blunt our resolve to pursue justice. The FBI will continue working with law enforcement and private sector partners to identify malicious cyber actors, disrupt their operations, and impose real cost on them, wherever they operate.”

The case has been assigned to US District Judge Jesse M. Furman.

The charges come more than eight years after the original indictment against nine members of the group was made public and demonstrate Washington’s continuing effort to pursue individuals accused of conducting cyber operations for the Iranian state.

The allegations contained in the indictment have not been proven in court.