DOJ charges 17 Iranians in massive cybertheft campaign linked to Revolutionary Guard Corps

The Department of Justice (DOJ) announced charges against 17 Iranian citizens for their alleged participation in a widespread cyberespionage and information theft operation carried out, in part, on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC) and other Iranian entities.

According to the official statement released by the DOJ, a 14-count superseding indictment names members of the Mabna Institute, an Iran-based company that allegedly has been conducting a coordinated cyber intrusion campaign since at least 2013.

The network is alleged to have attacked the systems of 144 U.S. universities, 178 foreign universities, at least 42 private U.S. companies, 11 foreign companies, five U.S. government agencies and several international organizations.

Over 100,000 professors targeted

The scope of the operation was particularly broad within the academic sector. The DOJ alleges that the hackers targeted more than 100,000 faculty accounts worldwide and managed to compromise approximately 8,000 email accounts.

Using stolen credentials, the defendants allegedly accessed scientific articles, theses, e-books and research papers across multiple disciplines. In total, the organization managed to extract at least 31.5 terabytes of academic information and intellectual property, which were subsequently transferred to servers outside the United States.

According to the indictment, the affected U.S. universities had spent more than $3.4 billion to acquire and access that data and those academic resources. Some of the stolen information was also allegedly sold in Iran through the websites Megapaper.ir and Gigapaper.ir.

U.S. agencies, the U.N. and HBO among the victims

The operation was not limited to universities. Investigators claim that the defendants accessed accounts belonging to the U.S. Department of Labor, the Federal Energy Regulatory Commission (FERC), the state governments of Hawaii and Indiana, the United Nations, and UNICEF, as well as dozens of private companies.

The DOJ also links several members of the network to the attack on HBO, in which confidential information was stolen and the company was subsequently subjected to an extortion attempt for approximately $6 million in Bitcoin. Other attacks attributed to the group resulted in more than $20 million in investigation and remediation costs for the victims.

Federal prosecutor Jamie McDonald described the case as an alleged state-sponsored campaign aimed at stealing research and intellectual property from U.S. universities, companies and government institutions. The FBI stated that the defendants had allegedly created an extensive "hackers-for-hire" operation on behalf of the Iranian government.