US widens case against Iranian university-hacking network
Force in PlayA 2018 indictment of the Mabna Institute grows to 17 defendants accused of stealing 31 terabytes of research
Yesterday: Superseding indictment adds eight defendantsNew here? Follow stories to track developments over time. Create a free account to get updates when stories you care about change.
Overview
Updated YesterdayFor four years, Iranian operators logged into US university networks using professors' stolen passwords and copied their research. This week, prosecutors expanded a 2018 case against the group behind it, adding eight names and bringing the total charged to 17.
The group, called the Mabna Institute, allegedly stole about 31.5 terabytes of academic data for Iran's Islamic Revolutionary Guard Corps. None of the 17 defendants is in US custody, and all are believed to be in Iran. The indictment is a public accusation, not a path to a trial.
Why it matters
The research behind US industry and defense sits on university networks, and this case shows a foreign state copied 31 terabytes of it with little fear of arrest.
Questions about this story
Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.
No questions yet — be the first to ask.
Key Indicators
Voices
Curated perspectives — historical figures and your fellow readers.
Play
Exploring all sides of a story is often best achieved with Play.
Higher or Lower
A number from this story, against one from elsewhere in the news — guess which is bigger, then keep the chain going. 5 rounds, 3 strikes; a miss costs a strike and resets your streak.
Keyboard: ↓/L lower · ↑/H higher
0 points — sign up to put that on the leaderboard.
Timeline
Order five events from this story, oldest at top. Each in the right slot scores 1 — neighbours within one slot count too. Your previous result — green ✓ for exact slots, yellow ~ for off by one. Cards now in true chronological order.
Sign up to save your score and track a streak across stories.
Connections
Sixteen names from the news. Find the four hidden groups of four. Four mistakes max.
Sign up to keep a daily streak — a new puzzle lands every day.
Exit debate?
Your progress in this debate will be lost.
- 1 Two AI personas square off on this story.
- 2 You predict who'll win each round — correct picks earn XP.
- 3 One crossfire question is yours to fire. Pick it carefully.
Couldn't generate a topic
Select Your Champions
Choose one persona for each side of the debate
DEBATE TOPIC
Choose personas with different perspectives for a more dynamic debate.
Select debater for this side:
No debate personas available right now.
Select debater for this side:
No debate personas available right now.
Who's Got This Round?
Make your prediction before the referee scores
The referee scores both sides on
Round Results
Set the Crossfire
Pick the question both personas must answer in the final round
Debate Oracle! You called every round!
Sharp Instincts! You know your debaters!
The Coin Flip Strategist! Perfectly balanced!
The Contrarian! Bold predictions!
Inverse Genius! Try betting the opposite next time!
XP Breakdown
Prediction History
People Involved
Organizations Involved
An Iran-based company that prosecutors say hacked universities to obtain foreign research, working partly for the Islamic Revolutionary Guard Corps.
A branch of Iran's armed forces that US prosecutors say directed some of the Mabna Institute's theft.
Timeline
January 2013 August 2026
-
Superseding indictment adds eight defendants
Latest LegalA 14-count superseding indictment brings the total charged to 17 on counts including computer intrusion, wire fraud, and aggravated identity theft.
-
Separate case targets Russian 'bulletproof hosting'
LegalIn Ohio, the DOJ charges three Russians and two firms, Media Land and ML.Cloud, tied to over $62 million in cybercrime losses.
-
US charges nine, Treasury sanctions the group
LegalThe Southern District of New York indicts nine Mabna members; the Treasury sanctions the institute and 10 people the same day.
-
Four-year campaign totals 31.5 terabytes
InvestigationBy late 2017 the group has hit 144 US and 178 foreign universities plus dozens of companies and agencies, prosecutors say.
-
Mabna Institute founded and campaign begins
OriginGholamreza Rafatnejad and Ehsan Mohammadi found the firm, which starts phishing university staff to reach research databases.
Historical Context
3 moments from history that rhyme with this story — and how they unfolded.
PLA Unit 61398 indictment (2014)
The US charged five officers of China's People's Liberation Army with hacking Westinghouse, US Steel, Alcoa, and others to steal trade secrets. It was the first time the US criminally charged uniformed state actors for cyber theft.
China denied the charges and suspended a cyber working group with the US. The five officers were never arrested.
The case set the template of 'name and shame' indictments against hackers the US cannot reach, now standard practice.
Like the Mabna case, it charged foreign state agents who stayed home. The value was public attribution, not a trial.
Iranian DDoS and Bowman Dam indictment (2016)
The US charged seven Iranians tied to IRGC contractors with flooding 46 banks with denial-of-service attacks and breaching the controls of a small New York dam. The attacks ran from 2011 to 2013.
None of the seven was arrested. The charges drew attention to Iranian contractors working for the IRGC.
It established a pattern of US prosecutors targeting IRGC-linked front companies, the same structure alleged in the Mabna case.
Same sponsor, same model: private Iranian firms doing cyber work for the IRGC, charged but out of reach.
GRU Sandworm indictment (2020)
The US charged six officers of Russia's GRU military intelligence for the NotPetya malware, attacks on Ukraine's power grid, and disruption of the 2018 Winter Olympics. Damages ran into the billions.
The officers remained in Russia and were never tried. Allies issued coordinated condemnations.
It confirmed that even sweeping, well-documented indictments of state hackers rarely produce arrests.
Shows the ceiling on these cases: strong evidence and serious charges, but enforcement depends on the suspect leaving home soil.
