US Charges 17 Mabna Institute Members; Offers Up to $10 Million for Five
Summary
The US charged 17 Mabna Institute members over alleged intrusions targeting hundreds of organizations. The indictment alleges theft of more than 31 TB of research data; the US offers up to $10 million for information leading to five defendants’ arrests.
Key points
- The US announced charges against 17 members of Iran-based Mabna Institute for alleged hacking of organizations in the US and abroad.
- The indictment alleges the defendants targeted more than 100,000 professors and compromised roughly 8,000 email accounts at 144 US universities and 178 institutions abroad.
- The alleged access used stolen credentials to exfiltrate academic research and other documents, totaling more than 31 TB, according to the indictment.
- The indictment alleges that stolen data was sold through Megapaper and Gigapaper, companies affiliated with defendant Abdollah Karima.
- The defendants allegedly acted on behalf of Iran’s Islamic Revolutionary Guard Corps and private organizations.
- The US is offering rewards of up to $10 million for information leading to the arrests of five defendants.
Article Details
- Event Type
- The US announced criminal charges against 17 people associated with Mabna Institute and offered rewards of up to $10 million for information leading to the arrest of five defendants.
- Impact
- The indictment alleges the defendants targeted hundreds of organizations and more than 100,000 professors, compromised roughly 8,000 professor email accounts, and stole over 31 terabytes of academic data and intellectual property. It also alleges an attempted $6 million extortion of HBO.
MITRE ATT&CK
Threat Actors
Abdollah KarimaNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions; the indictment says two companies affiliated with him sold stolen data.Abuzar Gohari MoqadamNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions.AchillesIdentified in the article as an alias of Keyvan Fayaz, who was charged in connection with the alleged intrusions.Amir BaratiNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions.Arman KahzadianNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions; the US offered a reward for information leading to his arrest.bc.monsterIdentified in the article as an alias of Keyvan Fayaz, who was charged in connection with the alleged intrusions.Behzad MesriNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions; the US offered a reward for information leading to his arrest.Ehsan MohammadiNamed as a Mabna Institute founder and one of the 17 defendants charged in connection with the alleged intrusions.Gholamreza RafatnejadNamed as a Mabna Institute founder and one of the 17 defendants charged in connection with the alleged intrusions.Islamic Revolutionary Guard Corps (IRGC)The Justice Department says the defendants acted on behalf of the Islamic Revolutionary Guard Corps; this is an attributed claim in the article.Keyvan FayazNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions; the US offered a reward for information leading to his arrest.Mabna InstituteThe indictment describes the Iran-based institute as conducting alleged cyber intrusions to steal scientific resources and academic data.Manouchehr HashemlooNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions.Mohammed Reza SabahiNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions.Mojtaba GalekuhiNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions; the US offered a reward for information leading to his arrest.Mojtaba Ghaleh KouiIdentified in the article as an alias of Mojtaba Galekuhi, who was charged in connection with the alleged intrusions.Mostafa SadeghiNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions.Roozbeh SabahiNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions.Saber Shahbazi BallojehNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions; the US offered a reward for information leading to his arrest.Saeid HoushyarNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions.Sajjad TahmasebiNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions.Seyed Ali MirkarmiNamed among the people employed, contracted, or affiliated with Mabna Institute and charged in connection with the alleged intrusions.Skote VahshatIdentified in the article as an alias of Behzad Mesri, who was charged in connection with the alleged intrusions.The JokerIdentified in the article as an alias of Keyvan Fayaz, who was charged in connection with the alleged intrusions.Vahid KarimaIdentified in the article as an alias of Abdollah Karima, who was charged in connection with the alleged Mabna Institute intrusions.
Countries
Australiaroughly 8,000 professor email accounts at 144 universities in the US and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway,Canadaroughly 8,000 professor email accounts at 144 universities in the US and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland,China8,000 professor email accounts at 144 universities in the US and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, SaudiDenmarkprofessor email accounts at 144 universities in the US and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia,Finlandemail accounts at 144 universities in the US and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore,Germanyat 144 universities in the US and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, SouthIranThe US this week announced charges against 17 members of the Iran-based company Mabna Institute for hacking into hundreds of organizations in the US and abroad.Ireland144 universities in the US and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea,Israelin the US and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain,Italyin the US and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden,JapanUS and 178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland,Malaysia178 institutions in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey,Netherlandsin Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the UnitedNorwayCanada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom,PolandCanada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and otherSaudi ArabiaDenmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and other countries.SingaporeFinland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and other countries.South KoreaIreland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and other countries.SpainIsrael, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and other countries.SwedenIsrael, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and other countries.SwitzerlandJapan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and other countries.TurkeyMalaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and other countries.United KingdomNorway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and other countries.United StatesThe US this week announced charges against 17 members of the Iran-based company Mabna Institute for hacking into hundreds of organizations in the US and abroad.
Industries
Governmentuniversities in the US (144) and abroad (178), private companies in the US (42) and abroad (11), five government agencies in the US, and at least two NGOs, stealing over 31 terabytes of academic data and intellectualPrivate companiesIt has targeted universities in the US (144) and abroad (178), private companies in the US (42) and abroad (11), five government agencies in the US, and at least two NGOs, stealing over 31 terabytes of academic data and