The U.S. Department of Justice (DOJ) unsealed a 14-count indictment Tuesday charging 17 Iranian nationals with conducting a cyber theft campaign on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC). The indictment alleges the individuals targeted hundreds of universities and dozens of private companies to steal intellectual property and academic data.
The charges involve members of the Mabna Institute, an Iran-based company founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi. According to the DOJ, the institute operated as a contractor for Iranian governmental and private entities to perform hacking activities. A federal grand jury previously indicted nine of these defendants in 2018; the new filing supersedes those earlier charges.
Federal prosecutors stated that the group targeted 144 U.S. universities, 178 foreign universities, and 42 U.S. private companies. The DOJ also reported intrusions into the systems of five U.S. federal and state government agencies, 11 foreign private companies, and two non-governmental organizations. The campaign allegedly resulted in the theft of more than 31 terabytes of data and the compromise of employee email accounts.
The indictment also signals a continuing focus by federal law enforcement on state-sponsored cyber activity originating from Iran. By naming 17 specific individuals and unsealing charges that date back to 2018, the U.S. government is asserting its ability to track foreign nationals over long periods. However, the practical impact on the defendants remains limited as long as they stay outside U.S. jurisdiction. To address this, the State Department has offered a reward of up to $10 million for information leading to the location of five specific defendants: Saber Shahbazi Ballojeh, Keyvan Fayaz, Mojtaba Galekuhi, Arman Kahzadian, and Behzad Mesri.
The case involves charges of conspiracy to commit computer intrusions, wire fraud, and conspiracy to commit wire fraud. If apprehended and convicted, defendants face maximum sentences ranging from five years for computer intrusion to 20 years for wire fraud. While Jamie McDonald, the U.S. Attorney for the Southern District of New York, stated that the passage of time will not deter federal efforts to pursue those targeting the U.S., the source did not provide a specific date for future court proceedings or expected trials.