Full Report
The superseding indictment adds defendants and allegations against the Iranian firm accused of a massive cybertheft campaign against foreign universities and others. The post Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute appeared first on CyberScoop.
Analysis Summary
# Threat Actor: Mabna Institute
## Attribution & Identity
* **Identity:** A Tehran-based technology firm acting on behalf of the Iranian government and the Islamic Revolutionary Guard Corps (IRGC).
* **Aliases/Associated Groups:** Cobalt Dickens (referenced via historical context/associations).
* **Key Individuals:** Founded by Gholamreza Rafatnejad and Ehsan Mohammadi. The group utilizes a network of "hackers-for-hire."
* **Legal Status:** Subject to a 2026 superseding federal indictment naming 17 defendants (an expansion of a 2018 indictment).
## Activity Summary
The Mabna Institute has conducted a massive, years-long cyber-theft campaign beginning around 2013. Its primary mission is the systematic exfiltration of scientific research and intellectual property. Recent developments include a second wave of U.S. federal charges following the expiration of diplomatic deadlines between the U.S. and Iran. The actor has stolen approximately 31.5 terabytes of data to date.
## Tactics, Techniques & Procedures
* **Credential Theft:** Mass harvesting of login information, specifically targeting professors and university staff.
* **Spearphishing:** Targeting academic and government email accounts to gain unauthorized access.
* **Data Exfiltration:** Large-scale theft of academic journals, dissertations, and e-books.
* **Monetization:** In addition to state-sponsored intelligence gathering, the actor has been observed selling stolen data.
## Targeting
* **Sectors:** Higher Education (Universities), Government Agencies (Federal and State), and private sectors including Media/Entertainment and Scientific Research.
* **Geography:** Global reach, with heavy focus on the United States and over 21 other countries.
* **Victims:**
* **Universities:** 144 U.S. universities and 178 foreign universities; over 100,000 professors targeted.
* **Government:** At least five U.S. federal and state agencies.
* **Private Sector:** 42 U.S. companies and 11 foreign companies, including **HBO**.
## Tools & Infrastructure
* **Infrastructure:** The Mabna Institute operates as a front company in Tehran to coordinate hacker-for-hire activities.
* **Network:** Utilizes a "broader network" of contracted hackers to obfuscate direct state involvement.
## Implications
The Mabna Institute represents a strategic threat to national economic strength and security. By bypassing the $3.4 billion cost of procuring legitimate access to research, the actor accelerates Iran’s domestic scientific and military capabilities through intellectual property theft. The transition of cyber operations into a "central instrument of national power" suggests these campaigns will persist despite legal indictments.
## Mitigations
* **Identity Management:** Implementation of robust Multi-Factor Authentication (MFA) to prevent unauthorized access via stolen credentials.
* **Phishing Protections:** Enhanced email filtering and user awareness training specifically for faculty and researchers who may be targeted for their institutional access.
* **Access Controls:** Restricting access to sensitive academic databases and proprietary research repositories.
* **Monitoring:** Auditing large-scale data transfers or unusual login activity from foreign IP ranges associated with Iranian infrastructure.