Seventeen Iranian nationals have been hit with U.S. criminal charges over an alleged years-long cyberattack campaign that included an attempt to extort HBO for roughly $6 million in bitcoin, according to Bitcoin Magazine, citing the U.S. Department of Justice.
Justice Department links defendants to the Mabna Institute
The Justice Department said Tuesday that the 17 defendants were working with the Mabna Institute, which prosecutors described as a hacking outfit operating on behalf of Iran’s Islamic Revolutionary Guard Corps as well as other Iranian government and university clients.
Authorities said the campaign targeted hundreds of U.S. and international universities, dozens of companies, and at least five state and federal government agencies.
Indictment includes the HBO breach and bitcoin ransom demand
Part of the indictment named Behzad Mesri, who had previously been charged with hacking Home Box Office, or HBO, and stealing proprietary data. Prosecutors said Mesri later tried to extort approximately $6 million worth of bitcoin.
They also said five other defendants were directly involved in that hack: Saeid Houshyar, Manouchehr Hashemloo, Keyvan Fayaz, Saber Shahbazi Ballojeh, and Arman Kahzadian.
State Department offers reward
The State Department’s Rewards for Justice program is offering up to $10 million for information on the location of the defendants.
In a statement, U.S. Attorney Jamie McDonald for the Southern District of New York said: 「Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions.」
How prosecutors say the operation worked
Prosecutors said the Mabna Institute was founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi. They alleged that the organization acted at the direction of Iran’s Islamic Revolutionary Guard Corps and other Iranian clients.
According to the case, the stolen research was not sent only to Tehran’s intelligence services. It was also resold through two websites, Megapaper.ir and Gigapaper.ir. Prosecutors said Gigapaper.ir rented out hijacked professor login credentials, allowing Iranian customers to access foreign university libraries directly.
Costs cited by prosecutors
U.S. institutions had spent about $3.4 billion acquiring the material that was later stolen, prosecutors said. Separate victims then spent more than $20 million dealing with the fallout and cleaning up the breaches.
The report was first published by Bitcoin Magazine and written by Mathew Di Salvo.