The hackers used stolen credentials to access victim professors’ accounts and exfiltrate data and documents across engineering, medical, technology, and other fields. The Mabna Institute targeted the accounts of 100,000 academics around the world.

The group successfully compromised 8,000 professor email accounts at 144 US-based universities and 178 academic institutions internationally. The 178 international academic institutions targeted are located in Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey, and the United Kingdom.

Mabna is alleged to have targeted and compromised employee email accounts from at least five US federal and state government agencies. At least 42 US-based private companies and 11 foreign companies based in Germany, Italy, Switzerland, Sweden, and the UK were targeted.

The defendants allegedly sold the stolen data through Megapaper and Gigapaper, two companies affiliated with Abdollah Karima. The indicted individuals include Abdollah Karima, Mostafa Sadeghi, Seyed Ali Mirkarmi, Mohammed Reza Sabahi, Roozbeh Sabahi, Abuzar Gohari Moqadam, Sajjad Tahmasebi, Saeid Houshyar, Behzad Mesri, Manouchehr Hashemloo, Keyvan Fayaz, Amir Barati, Saber Shahbazi Ballojeh, Arman Kahzadian, and Mojtaba Galekuhi.

The charges are contained in a 14-count superseding indictment. Nine of the 17 members charged were previously charged in a seven-count indictment in March 2018.

The US Department of Justice is offering a $10 million reward for information leading to the location of five of the alleged hackers. The US government is offering rewards of up to $10 million for information leading to the arrest of Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh.

Why It Matters

The scale of the alleged intrusion spans hundreds of academic and private sector entities across multiple continents. The U.S. Department of Justice said that the Mabna Institute, an Iran-based company, has conducted a coordinated campaign of cyber intrusions into computer systems for 144 U.S.-based universities, 178 foreign universities, at least 42 U.S.-based private sector companies, at least 11 foreign private sector companies, at least five U.S. federal and state government agencies, and at least two non-governmental organizations (NGOs).

The operation represents a sustained effort to acquire intellectual property and sensitive data over several years. A study titled Iranian Cyber-activities in the Context of Regional Rivalries and International Tensions was published in 2019 in Repository for Publications and Research Data (ETH Zurich). Another study titled Forecasting Iranian Government Responses to Cyberattacks was published in 2022 in Journal of advanced military studies.

Timeline

In 2013, the Mabna Institute was founded by Gholamreza Rafatnejad and Ehsan Mohammadi. The Mabna Institute was founded in 2013 to assist Iranian academic organisations in stealing access to non-Iranian scientific resources. The campaign started in approximately 2013 and continued until at least December 2017.

In March 2018, nine of the 17 members charged were previously charged in a seven-count indictment. On August 19, 2026, the US Department of Justice charged 17 Iranians with conducting a coordinated cyber attack campaign to steal data from US organizations.

On August 19, 2026, FBI Assistant Director in Charge James C Barnacle Jr stated that backed by the IRGC, this operation reflects a broader, organized effort to target US institutions and global partners. Also on August 19, 2026, the US Department of Justice announced it is offering a $10 million reward for information leading to the location of five of the alleged hackers.

What's New

A study titled Forecasting Iranian Government Responses to Cyberattacks was published in 2022 in Journal of advanced military studies.

The U.S. Department of Justice (DoJ) said that the Mabna Institute, an Iran-based company, has conducted a coordinated campaign of cyber intrusions into computer systems for 144 U.S.-based universities, 178 foreign universities, at least 42 U.S.-based private sector companies, at least 11 foreign private sector companies, at least five U.S. federal and state government agencies, and at least two non-governmental organizations (NGOs). The U.S. Department of Justice (DoJ) said the Mabna Institute targeted the accounts of 100,000 academics around the world, and successfully compromised 8,000 professor email accounts at 144 U.S.-based universities and another 178 academic institutions internationally.

The defendants targeted HBO in a $6 million extortion attempt.

How Sources Differ

The justice.gov source states that the U.S. Department of Justice (DoJ) said that the Mabna Institute, an Iran-based company, has conducted a coordinated campaign of cyber intrusions into computer systems for 144 U.S.-based universities, 178 foreign universities, at least 42.

The US Department of Justice indictment states that the Mabna Institute targeted the computer systems of 144 American universities and 42 private sector firms since at least 2013.