US Charges 17 Iranian Hackers, Offers $10 Million Bounty for 5 Fugitives Over 31-Terabyte University Cyber Theft

The US Department of Justice has accused 17 alleged members of Iran's Mabna Institute of orchestrating a state-directed hacking campaign that stole more than 31 terabytes of academic data and intellectual property from universities, companies and government bodies worldwide since 2013.

The 14-count superseding indictment, unsealed on Tuesday, adds eight new defendants to a case first brought in March 2018.

Alongside the indictment, the US State Department's Rewards for Justice programme is offering up to $10 million for information leading to the location of five of the defendants who remain at large. The case is being heard in the Southern District of New York, with the UK's National Crime Agency credited as an investigative partner.

$10m Bounty Targets Five Fugitives

Although there are 17 defendants, the $10 million reward covers five named fugitives only: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz and Saber Shahbazi Ballojeh. It does not extend to the remaining 12 defendants named in the indictment.

The Rewards for Justice programme is soliciting tips through a Tor-based reporting channel, reflecting the difficulty of tracking suspects believed to be operating from within Iran.

Scale of the University Cyber Theft

Prosecutors allege the Mabna Institute, founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, targeted more than 100,000 professor email accounts globally and successfully compromised roughly 8,000 of them across 144 US universities and 178 institutions abroad, including in the UK, Germany, Japan and Israel.

The stolen material spanned academic journals, theses, dissertations and e-books across every major discipline. US universities are estimated to have spent approximately $3.4 billion procuring or re-accessing the compromised data and intellectual property over the course of the conspiracy.

Separately, the group is accused of compromising employee email accounts at 42 US companies, 11 foreign firms, five US federal and state agencies, and organisations including the UN, UNICEF and the US Department of Labor, causing more than $20 million in investigation and remediation costs.

Stolen Credentials Sold Through Iranian Websites

Beyond providing material to the Iranian government, prosecutors say the group turned the theft into a commercial operation. Stolen research and login credentials were sold through two Iran-based websites, Megapaper.ir and Gigapaper.ir, both linked to defendant Abdollah Karima, also known as 'Vahid Karima', via his company Falinoos.

Megapaper reportedly sold stolen academic resources directly to Iranian public universities and institutions.

Gigapaper offered paying customers inside Iran a subscription-style service letting them use compromised professor logins to access university library systems in the US and abroad. In effect, they created a black-market interlibrary loan scheme built on stolen credentials.

Nuclear and Israeli Infrastructure Links

Fugitive Mesri was separately indicted in 2017 for the hack of HBO, in which he allegedly stole scripts and unaired episodes of 'Game of Thrones' and attempted to extort the network for $6 million in Bitcoin.

That earlier indictment described Mesri as having 'previously worked on behalf of the Iranian military to conduct computer network attacks that targeted military systems, nuclear software systems and Israeli infrastructure'.

Four of the newly added defendants, Saeid Houshyar, Manouchehr Hashemloo, Fayaz and Ballojeh, were also directly involved in the HBO breach.

Wider Iran Cyber Campaign

The charges arrive as US officials contend with a separate, ongoing wave of Iran-linked cyber activity tied to the broader conflict between the US, Israel and Iran. Water and wastewater facilities across at least seven states have reported intrusions since July, with investigators privately pointing to Iranian-affiliated actors, though no formal attribution has been made public.

In March, a group calling itself the Handala Hack Team, reported to have links to Iranian intelligence, breached the personal email account of FBI Director Kash Patel and published hundreds of messages and photographs online.

US Officials Set Out Their Case

Assistant Attorney General for National Security John Eisenberg said the defendants 'hacked into universities and other research institutions worldwide, stealing at least 31 terabytes of information and intellectual property of untold value.'

US Attorney Jamie McDonald for the Southern District of New York said the passage of time 'will not deter us from identifying and pursuing those who target the United States from abroad.'

FBI Cyber Division Assistant Director Brett Leatherman added: 'The FBI's memory is long, and time will not blunt our resolve to pursue justice'.

Case Background and Next Steps

Nine of the 17 defendants were first charged in March 2018 alongside Treasury sanctions against the Mabna Institute. The case has been assigned to US District Judge Jesse M. Furman.

As with all criminal charges, the indictment represents an allegation only, and each defendant is presumed innocent unless and until proven guilty in court.