17 Iranians Charged With Conducting Massive Cyber Theft Campaign On Behalf Of The Islamic Revolutionary Guard Corps And Other Iranian Entities

United States Attorney for the Southern District of New York, Jamie McDonald, Assistant Attorney General for National Security, John A. Eisenberg, and Assistant Director in Charge of the New York Field Office of the Federal Bureau of Investigation ("FBI"), James C. Barnacle, Jr., announced today the unsealing of a 14-count Superseding ("S2") Indictment charging 17 members of the Mabna Institute, an Iran-based company that, since at least 2013, conducted a coordinated campaign of cyber intrusions into computer systems to 144 U.S.-based universities, 178 foreign universities, at least 42 U.S.-based private sector companies, at least 11 foreign private sector companies, at least five U.S. federal and state government agencies, and at least two non-governmental organizations ("NGOs"). Through the defendants' activities, the Mabna Institute stole more than 31 terabytes of academic data and intellectual property from universities, and the email accounts of employees at private sector companies, government agencies, and non-governmental organizations. The defendants conducted many of these intrusions on behalf of the Islamic Republic of Iran's ("Iran") Islamic Revolutionary Guard Corps ("IRGC"), one of several entities within the government of Iran responsible for gathering intelligence, as well as other Iranian government and university clients. Nine of the 17 defendants charged in the S2 Indictment were previously charged in a 7-count Indictment announced in March 2018. The case is assigned to U.S. District Judge Jesse M. Furman.

"Today's charges show that neither sophistication nor geographic boundaries will deter us from protecting the national security of our country from those who target the United States from abroad," said U.S. Attorney Jamie McDonald. "These charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions. Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength. This Office and our partners will continue to protect American innovation and pursue accountability for the individuals behind these attacks."

"The superseding indictment alleges that, at the behest of entities including the IRGC, these defendants hacked into universities and other research institutions worldwide, including the United States, stealing at least 31 terabytes of information and intellectual property of untold value," said Assistant Attorney General for National Security John A. Eisenberg. "The National Security Division is committed to protecting the United States from such predators and will pursue those who perpetrate such crimes for as long as it takes to bring them to justice."

"Coordinated cyber intrusions like those allegedly carried out by the 17 members of the Mabna Institute represent a serious threat to our national security," said FBI Assistant Director in Charge James C. Barnacle, Jr. "Their campaign stole vast amounts of intellectual property and sensitive information, reinforcing the FBI's commitment to confront this activity head-on. Backed by the IRGC, this operation reflects a broader, organized effort to target U.S. institutions and global partners. No matter where these actors operate or how they attempt to hide, the FBI will persist in its efforts to disrupt this criminal activity."

According to the allegations contained in the S2 Indictment:(1)

Background on the Mabna Institute

GHOLAMREZA RAFATNEJAD and EHSAN MOHAMMADI founded the Mabna Institute in approximately 2013 to assist Iranian universities and scientific and research organizations in stealing access to non-Iranian scientific resources. In furtherance of its mission, the Mabna Institute employed, contracted, and affiliated itself with hackers-for-hire and other contract personnel to conduct cyber intrusions to steal academic data, intellectual property, email inboxes and other proprietary data, including ABDOLLAH KARIMA, a/k/a "Vahid Karima," MOSTAFA SADEGHI, SEYED ALI MIRKARIMI, MOHAMMED REZA SABAHI, ROOZBEH SABAHI, ABUZAR GOHARI MOQADAM, SAJJAD TAHMASEBI, SAEID HOUSHYAR, BEHZAD MESRI, a/k/a "Skote Vahshat," MANOUCHEHR HASHEMLOO, KEYVAN FAYAZ, a/k/a "Achilles," a/k/a "The Joker," a/k/a "bc.monster," AMIR BARATI, SABER SHAHBAZI BALLOJEH, ARMAN KAHZADIAN, and MOJTABA GALEKUHI, a/k/a "Mojtaba Ghaleh Koui." The Mabna Institute contracted with both Iranian governmental and private entities to conduct hacking activities on their behalf, and specifically conducted the university spearphishing campaign on behalf of the IRGC. The Mabna Institute is located at Tehran, Sheikh Bahaii Shomali, Koucheh Dawazdeh Metri Sevom, Plak 14, Vahed 2, Code Posti 1995873351.

University Hacking Campaign

The Mabna Institute, through the activities of the defendants, targeted more than 100,000 accounts of professors around the world. They successfully compromised approximately 8,000 professor email accounts across 144 U.S.-based universities, and 178 universities located in foreign countries, including Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey and the United Kingdom. The campaign started in approximately 2013, continued through at least December 2017, and broadly targeted all types of academic data and intellectual property from the systems of compromised universities. Through the course of the conspiracy, U.S.-based universities spent more than approximately $3.4 billion to procure and access such data and intellectual property.

The members of the conspiracy used stolen account credentials to obtain unauthorized access to victim professor accounts, which they used to steal research, and other academic data and documents, including, among other things, academic journals, theses, dissertations, and electronic books. The defendants targeted data across all fields of research and academic disciplines, including science and technology, engineering, social sciences, medical, and other professional fields. The defendants stole at least approximately 31.5 terabytes of academic data and intellectual property, which they exfiltrated to servers outside the United States that were under the control of members of the conspiracy.

In addition to stealing academic data and login credentials for the benefit of the Government of Iran, the defendants also sold the stolen data through two websites, Megapaper.ir (Megapaper) and Gigapaper.ir (Gigapaper). Megapaper was operated by Falinoos Company, a company controlled by ABDOLLAH KARIMA, a/k/a "Vahid Karima," and Gigapaper was affiliated with KARIMA. Megapaper sold stolen academic resources to customers within Iran, including Iran-based public universities and institutions, and Gigapaper sold a service to customers within Iran whereby purchasing customers could use compromised university professor accounts to directly access the online library systems of particular U.S.-based and foreign universities.

Private Sector and Governmental and Non-Governmental Organization Hacking Campaigns

In addition to targeting and compromising universities, the defendants targeted and compromised and exfiltrated employee email accounts for at least approximately at least five U.S. federal and state government agencies, at least 42 U.S. based private sector companies, at least approximately 11 foreign companies based in Germany, Italy, Switzerland, Sweden, and the United Kingdom, and various governmental and non-governmental organizations within the U.S., including the U.S. Department of Labor, the Federal Energy Regulatory Commission, the State of Hawaii, the State of Indiana, the United Nations, and the United Nations Children's Fund.

Eight Additional Defendants Charged in the S2 Indictment

The S2 Indictment charges eight additional defendants and describes continued efforts by the Mabna Institute to target American and international institutions. For example, the defendants targeted Home Box Office, Inc. ("HBO"), a media and entertainment company headquartered in New York, New York. MESRI was separately charged in United States v. Behzad Mesri, 17 Cr. 689 (AJN), with hacking into HBO's computer systems, stealing proprietary data, and then attempting to extort HBO for approximately $6 million worth of Bitcoin, a form of digital currency. HOUSHYAR, HASHEMLOO, FAYAZ, BALLOJEH, and KAHZADIAN were also directly involved in the hack of HBO's systems along with MESRI.

In addition, GALEKUHI, FAYAZ, and BALLOJEH participated in the Mabana Institute's efforts to hack into private sector companies and at least two governmental entities-including through password spray attacks, obtaining unauthorized access to victim systems, and exfiltrating data-causing victims to have suffered from an excess of $20 million in costs to investigate and remediate the intrusions. BARATI moreover was involved in tracking the progress of the spearfishing campaigns, exchanging login credentials for compromised accounts with other co-conspirators, creating targeting lists, conducting computer network reconnaissance, and crafting spearfishing messages.

Concurrent with the unsealing of the S2 Indictment, the U.S. Department of State's Rewards for Justice program ("RFJ") is offering a reward of up to $10 million for information leading to the location of defendants MESRI, GALEKUHI, KAHZADIAN, FAYAZ, and BALLOJEH. The RFJ program seeks information on any person who, while acting at the direction or under the control of a foreign government, engages in certain malicious cyber activities in violation of the Computer Fraud and Abuse Act.

Anyone with information on these malicious cyber actors, or associated individuals or entities, please contact Rewards for Justice via the Tor-based tips-reporting channel at: he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion. More information about this RFJ reward offer is located on the Rewards for Justice websiteLinks to other government and non-government sites will typically appear with the "external link" icon to indicate that you are leaving the Department of Justice website when you click the link..

* * *

A chart containing the names, charges, and maximum penalties for the defendants is set forth below.

The maximum potential sentences in this case are prescribed by Congress and provided here for informational purposes only, as any sentencing of the defendants will be determined by the judge.

Mr. McDonald praised the outstanding investigative work of the FBI. He also thanked the Department of Justice's Office of International Affairs. Mr. McDonald further thanked the RFJ Program for their support.

Assistant U.S. Attorneys Nicholas W. Chiuchiolo, Connie L. Dang, and Adam Sowlati are in charge of the prosecution, with assistance provided by Trial Attorney Jacques Singer-Emery of the National Security Division's National Security Cyber Section.

The charges contained in the S2 Indictment are merely accusations and the defendants are presumed innocent unless and until proven guilty.

1. ^

   As the introductory phrase signifies, the entirety of the text of the Indictment and the description of the Indictment set forth herein constitute only allegations, and every fact described therein should be treated as an allegation.