DOJ secures indictment of 17 Iranians accused of ‘massive’ cyber theft campaign

U.S. Prosecutors Unveil Sweeping Charges Against Iranian Cyber Unit That Plundered University Research

Provpnadvice.com – State-sponsored digital espionage aimed at America’s academic and corporate institutions has taken center stage in federal court. On Tuesday, the Department of Justice pulled the seal from a 14-count indictment naming 17 Iranian nationals accused of orchestrating a prolonged operation to extract research data, intellectual property, and corporate credentials from institutions across the United States and abroad. The operation, prosecutors say, was carried out under the direction of Iran’s Islamic Revolutionary Guard Corps (IRGC) and represented one of the most extensive documented campaigns of academic data theft ever brought before a U.S. grand jury.

The Scope of the Alleged Intrusions

The indictment targets members of the Mabna Institute, an Iran-based technology firm that federal prosecutors allege functioned as the operational arm of the IRGC’s cyber-espionage apparatus. According to the department’s filing, the institute penetrated the computer systems of at least 144 universities located in the United States, 178 universities in other countries, and 42 private companies operating domestically. Beyond the academic sector, the alleged intrusions reached at least 11 foreign private firms, five U.S. federal and state government agencies, and two nongovernmental organizations.

In total, prosecutors say the defendants exfiltrated more than 31 terabytes of academic data and proprietary intellectual property, along with the email credentials of employees at the affected private companies, government bodies, and NGOs. The sheer volume of stolen material underscores how deeply embedded the operation was within institutional networks over an extended period.

IRGC Direction and Contractual Arrangements

The department’s release makes clear that the university spearfishing campaign was not an independent corporate exercise. The Mabna Institute conducted its operations specifically on behalf of the IRGC, the military wing of Iran’s government that has long maintained a dedicated cyber command. In addition to its own targeting, the institute allegedly contracted with other Iranian governmental and private entities to perform hacking activities on their behalf, suggesting a layered network of actors operating under a single strategic umbrella.

The firm was founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi. Its relatively brief existence—spanning roughly the period of the indictment—coincides with a surge in Iranian cyber activity directed at Western academic and industrial targets, a pattern consistent with broader IRGC objectives of tracking research trajectories and weakening competitors’ technological pipelines.

Prosecution Timeline and the Superseding Indictment

The case did not begin with Tuesday’s unsealing. A federal grand jury first indicted nine of the 17 defendants on seven counts in 2018. The newly unsealed document supersedes that earlier filing, expanding both the number of accused individuals and the breadth of charges. Prosecutors emphasized that the additional years between the original indictment and its public disclosure allowed investigators to build a fuller picture of the operation.

Official Statements

Jamie McDonald, the U.S. attorney for the Southern District of New York, framed the charges as a window into a larger architecture of state-directed theft:

“Reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions.”

McDonald also addressed the long gap between the initial indictment and its eventual public release:

“More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad.”

McDonald assumed the Southern District of New York post last month, succeeding Jay Clayton, who departed to serve as director of national intelligence.

Charges, Penalties, and the Reward

The 14 counts span a range of offenses. At the lower end sits conspiracy to commit computer instructions, carrying a maximum prison term of five years. At the upper end are wire fraud and conspiracy to commit wire fraud, each punishable by up to 20 years behind bars. Not every count applies to every defendant; the indictment allocates charges across the 17 accused according to their individual roles in the operation.

Separately, the State Department has placed a bounty of up to $10 million on information leading to the location of five defendants who remain at large: Saber Shahbazi Ballojeh, Keyvan Fayaz, Mojtaba Galekuhi, Arman Kahzadian, and Behzad Mesri. The reward signals that the government views these individuals as still reachable and that continued pursuit remains a priority.

Why the Case Matters

Academic institutions have long been among the most attractive targets for foreign cyber-espionage because they house decades of unpublished research, grant-funded projects, and early-stage intellectual property that can shape national competitive advantage. A campaign of the scale described here—touching hundreds of universities and dozens of private firms—raises questions about how widely institutional data may have been exposed and whether downstream effects on published research, patent filings, or corporate strategy have already materialized. For universities and research labs, the indictment serves as a reminder that network security is not merely an IT concern but a matter of national economic and scientific interest.