The US has taken a significant step in combating state-sponsored cyber attacks by charging 17 Iranian hackers affiliated with the Mabna Institute. This group, allegedly founded by Iran’s Islamic Revolutionary Guard Corps (IRGC), has been stealing sensitive information from universities, research organizations, and private companies around the world.
According to a superseding indictment, the Mabna Institute was established in 2013 to help Iranian universities access non-Iranian scientific resources. However, its true purpose appears to be far more sinister. The hackers have targeted over 1,000 institutions globally, including 144 US universities, five government agencies, and at least two NGOs. They’ve stolen a staggering 31 terabytes of academic data, intellectual property, and employee email accounts.
The indictment alleges that the Mabna Institute was founded by Gholamreza Rafatnejad and Ehsan Mohammadi, with Abdollah Karima (also known as Vahid Karima) acting as a key player. The group’s activities have been linked to both the Iranian government and private organizations.
One of the most disturbing aspects of this case is the sheer scale of the hacking operation. The defendants allegedly targeted over 100,000 professors worldwide, compromising around 8,000 email accounts at universities in various countries. Using stolen credentials, they accessed sensitive data across multiple fields of research, including engineering, medicine, and technology.
The hackers also sold the stolen data through two companies affiliated with Abdollah Karima: Megapaper and Gigapaper. Moreover, they attempted to extort HBO for $6 million.
In response to this brazen cyber attack, the US government has offered rewards of up to $10 million through its Rewards for Justice (RFJ) program for information leading to the arrest of five key suspects: Behzad Mesri (also known as Skote Vahshat), Mojtaba Galekuhi (also known as Mojtaba Ghaleh Koui), Arman Kahzadian, Keyvan Fayaz (also known as Achilles, The Joker, and bc.monster), and Saber Shahbazi Ballojeh.
This case highlights the ongoing threat of state-sponsored cyber attacks and the need for vigilance among researchers, academics, and private companies. It also underscores the importance of international cooperation in combating these threats.
So what can you do to protect yourself from similar attacks? Firstly, be cautious when receiving unsolicited emails or messages, especially those requesting sensitive information. Secondly, ensure that your organization has robust cybersecurity measures in place, including multi-factor authentication and regular software updates. Lastly, stay informed about the latest cyber threats and trends through reputable sources like CyberNews.work.
By working together, we can reduce the impact of these attacks and create a safer online environment for everyone.
Source: SecurityWeek — 2026-08-19