DOJ Charges 17 Iranians in Campaign Targeting Over 300 Universities

A cyberattack by the Mabna Institute compromised hundreds of universities, companies, and other victims in order to extract research, academic data, and intellectual property.

by Tim Leogrande, BSIT, MSCP, Ed.S.

🗓 AUG 27 2026 • 2 MIN READ

📰 NEWS

On Tuesday, August 18, federal prosecutors in Manhattan unsealed a 14-count superseding indictment charging 17 members of the Iran-based Mabna Institute with running a coordinated campaign of cyber intrusions against universities, companies, and government agencies worldwide. The new filing replaces a 2018 indictment against nine of the same defendants. It also adds eight more. This vastly expands the scope of the case.

The DOJ says that as early as 2013, Mabna carried out intrusions on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC), as well as other Iranian government and university clients. According to prosecutors, the group compromised the computer networks of 144 U.S.-based universities, 178 foreign universities, at least 42 U.S.-based private sector companies, at least 11 foreign private sector companies, at least five U.S. federal and state agencies, and at least two non-governmental organizations.

<aside> 💡

The defendants are accused of stealing more than 31 terabytes of academic data and intellectual property. U.S. universities spent over $3.4 billion to license and procure the kind of research the defendants allegedly took. Mabna targeted more than 100,000 professor accounts worldwide and successfully compromised roughly 8,000 of them, according to the DOJ.

</aside>

“Coordinated cyber intrusions like those allegedly carried out by the 17 members of the Mabna Institute represent a serious threat to our national security,” said James C. Barnacle Jr., Assistant Director in Charge of the FBI’s New York Field Office.

The indictment also describes how the information was sold. Two Iranian websites profited from the intrusions. One sold the information that had been obtained, and the other let customers use stolen faculty credentials to browse university library systems.

Cyber operations have “become a central instrument of national power,” said Jamie McDonald, U.S. Attorney for the Southern District of New York, adding that “attacks on American and allied institutions carry direct consequences for our security and economic strength.” The charges, he said, “reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions.”

Prosecutors say Gholamreza Rafatnejad and Ehsan Mohammadi founded the Mabna Institute around 2013 to help Iranian universities and research organizations obtain foreign scientific resources.

The State Department’s Rewards for Justice program is offering up to $10 million for information leading to the location of five defendants: Keyvan Fayaz, Arman Kahzadian, Mojtaba Galekuhi, Saber Shahbazi Ballojeh, and Behzad Mesri.

The defendants face charges including conspiracy to commit computer intrusions, wire fraud, and aggravated identity theft. Some of the charges carry a maximum sentence of up to 20 years.