Iranian Hacking Ring Busted: $6M Bitcoin Ransom Part of Sprawling Cybercrime Spree!

Seventeen Iranian individuals have been criminally charged by U.S. federal authorities for allegedly orchestrating a sophisticated, years-long campaign of cyberattacks, which notably included an attempt to extort Home Box Office (HBO) for $6 million in Bitcoin. The U.S. Department of Justice announced Tuesday that these individuals were affiliated with the Mabna Institute, a group accused of conducting hacking operations on behalf of Iran’s Islamic Revolutionary Guard Corps and other Iranian government and academic clients.

The sprawling cyber campaign targeted a vast array of victims, encompassing hundreds of U.S. and international universities, dozens of companies, and at least five state and federal government agencies. A significant part of the indictment references Behzad Mesri, who had previously faced charges for hacking HBO, stealing its proprietary data, and subsequently attempting to extort approximately $6 million worth of Bitcoin from the entertainment giant. Prosecutors further implicated five additional defendants—Saeid Houshyar, Manouchehr Hashemloo, Keyvan Fayaz, Saber Shahbazi Ballojeh, and Arman Kahzadian—as directly involved in the HBO hack.

The Mabna Institute, founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, is alleged to have operated at the behest of various Iranian entities, including the Islamic Revolutionary Guard Corps. The stolen research and intellectual property were not exclusively channeled to Tehran’s intelligence services; prosecutors contend that the material was also resold through two websites, Megapaper.ir and Gigapaper.ir. The latter reportedly facilitated the rental of hijacked professor login credentials, granting Iranian customers unauthorized access to foreign university libraries.

The financial ramifications of these breaches were substantial. U.S. institutions alone had invested approximately $3.4 billion to acquire the intellectual property that was stolen. Moreover, various victims collectively incurred over $20 million in costs for remediation and cleanup efforts following the cyberattacks. In response to these charges, the State Department’s Rewards for Justice program is offering a reward of up to $10 million for information leading to the location of the defendants.

U.S. Attorney Jamie McDonald for the Southern District of New York emphasized the gravity of the situation, stating, “Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions.” This comprehensive indictment underscores the scale and state-backed nature of the cyberespionage and criminal activities attributed to the Mabna Institute and its operatives.