Full Report
The U.S. has charged 17 Iranians, alleged members of a hacking-for-hire company called Mabna Institute, involved in years-long operations that stole data from American organizations. [...]
Analysis Summary
# Threat Actor: Mabna Institute
## Attribution & Identity
* **Actor Name:** Mabna Institute
* **Aliases:** Silent Librarian, TA407, COBALT DICKENS.
* **Known Individuals:** 17 Iranians charged, including:
* Saeid Houshyar
* Behzad Mesri (aka “Skote Vahshat”)
* Manouchehr Hashemloo
* Keyvan Fayaz (aka “Achilles,” “The Joker,” “bc.monster”)
* Amir Barati
* Saber Shahbazi Ballojeh
* Arman Kahzadian
* Mojtaba Galekuhi (aka “Mojtaba Ghaleh Koui”)
* **Associated Groups:** Linked to the Islamic Republic of Iran’s Islamic Revolutionary Guard Corps (IRGC).
* **Nature:** State-sponsored "hacking-for-hire" entity.
## Activity Summary
The Mabna Institute has conducted massive, multi-year cyber operations dating back to approximately 2013. The most recent legal developments in 2026 involve charges against 17 members for the theft of over 31.5 terabytes of data, including intellectual property and academic research valued at approximately $3.4 billion. Notable historical operations include a 2017 extortion attempt against HBO and large-scale credential harvesting targeting global academic institutions.
## Tactics, Techniques & Procedures
* **Credential Harvesting:** Large-scale spear-phishing campaigns targeting professors and university staff to steal login credentials.
* **Account Compromise:** Leveraging valid credentials to bypass perimeter security and access internal databases.
* **Exfiltration:** Systematic theft of massive volumes of data (terabytes of academic journals, theses, and research).
* **Extortion:** Hacking private media organizations and demanding cryptocurrency (Bitcoin) ransoms to prevent the release of stolen content.
* **Identity Theft:** Use of stolen personal information to facilitate further intrusions.
* **MITRE ATT&CK Mapping (Inferred):**
* T1566 (Phishing)
* T1078 (Valid Accounts)
* T1567 (Exfiltration Over Web Service)
* T1657 (Financial Theft/Extortion)
## Targeting
* **Sectors:** Higher Education (Universities), Private Sector/Corporate, Government Agencies, Non-Governmental Organizations (NGOs), Media/Entertainment.
* **Geography:** Primarily United States; global targeting affecting professors and institutions worldwide.
* **Victims:**
* 178 Universities (144 in the U.S.).
* 53 Private Firms (42 in the U.S.).
* HBO (Home Box Office).
* 10 U.S. State Agencies.
* Over 100,000 professors (approximately 8,000 successfully compromised).
## Tools & Infrastructure
* **Malware/Tools:** While the specific article focuses on credential-based access, the actor is known for using custom spear-phishing kits and scripts for data scraping.
* **Payment Infrastructure:** Bitcoin for extortion payments.
* **Infrastructure:**
* Deceptive login portals mimicking university library portals.
* Anonymous reporting channels via Tor (utilized by U.S. law enforcement for tips).
## Implications
The Mabna Institute represents a significant strategic threat to national competitiveness and intellectual property. By operating as a "hacking-for-hire" entity for the IRGC and other Iranian government bodies, they provide the state with low-cost access to global research, saving the regime billions in R&D costs. Their transition from academic theft to high-profile corporate extortion (e.g., HBO) demonstrates a dual motivation of state intelligence requirements and financial gain.
## Mitigations
* **Multi-Factor Authentication (MFA):** Implementation of robust MFA, particularly FIDO2-based hardware keys, to negate the effectiveness of stolen credentials.
* **Phishing Awareness Training:** Specific training for academic staff to recognize sophisticated library-themed credential harvesting attempts.
* **Identity Threat Detection & Response (ITDR):** Monitoring for anomalous login patterns or mass data downloads from university library accounts.
* **Credential Rotation:** Enforcing policy-driven credential updates following detected phishing waves.
* **Network Segmentation:** Restricting access to sensitive proprietary research and intellectual property databases based on the principle of least privilege.