US charges Iranian hackers over $3.4 billion intellectual property theft
- August 19, 2026
- 11:56 AM
- 0
The U.S. has charged 17 Iranians, alleged members of a hacking-for-hire company called Mabna Institute, involved in years-long operations that stole data from American organizations.
Nine of the defendants were previously charged in a March 2018 indictment for hacking more than 300 universities and private companies.
The U.S. Justice Department (DoJ) has also announced rewards of up to $10 million for information leading to the location of five of the 17 Iranian defendants.
According to the U.S. government, the newly charged eight individuals stole academic research, intellectual property, emails, and other proprietary information.
The DoJ says that the Iranians listed below were involved in cyber operations for the Islamic Republic of Iran’s Islamic Revolutionary Guard Corps (IRGC), other Iranian government bodies, universities, and paying customers.
- Saeid Houshyar
- Behzad Mesri, aka “Skote Vahshat”
- Manouchehr Hashemloo
- Keyvan Fayaz, aka “Achilles,” “The Joker,” and “bc.monster”
- Amir Barati
- Saber Shahbazi Ballojeh
- Arman Kahzadian
- Mojtaba Galekuhi, aka “Mojtaba Ghaleh Koui”
“Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” stated U.S. Attorney Jamie McDonald.
“More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad.”
The DoJ's announcement says the operation is believed to have begun around 2013 and targeted the accounts of more than 100,000 professors worldwide, successfully compromising roughly 8,000 of them.
Using access to these accounts, the hackers reportedly stole 31.5 terabytes of academic data, including journals, theses, dissertations, ebooks, and research across numerous disciplines, valued at approximately $3.4 billion.
This activity has impacted 178 universities, 144 of which are in the U.S., at least 53 private firms, 42 of which are in the U.S., two NGOs, and at least 10 U.S. state agencies.
One of the victims highlighted in the announcement was HBO, which was reportedly extorted for $6 million worth of Bitcoin.
The defendants now face charges related to conspiracy to commit computer intrusions, wire fraud, unauthorized access for financial gain, and aggravated identity theft, which can incur maximum penalties of up to 20 years in prison.
The State Department has also announced it is offering rewards of up to $10,000,000 for information leading to the whereabouts of Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh.
A Tor link has also been provided to allow anonymous submissions. All defendants are presumed innocent until proven guilty in a court of law.
.article-callout { background-color: #f0f6ff; width: 95%; max-width: 800px; margin: 15px auto; border-radius: 8px; border: 1px solid #d6ddee; display: flex; align-items: stretch; overflow: hidden; } .article-media { flex: 1; max-width: 220px; display: flex; } .article-media a { display: flex; width: 100%; height: 100%; } .article-media img { width: 100%; height: 100%; border-radius: 8px 0 0 8px; display: block; } .article-callout .article-media img { margin-top: 0 !important; height: 100% !important; } .article-body { flex: 2; padding: 10px; display: flex; flex-direction: column; justify-content: center; } .article-body h2 { font-size: 17px !important; font-weight: 700; color: #333; line-height: 1.4; font-family: Georgia, "Times New Roman", Times, serif; margin: 0 0 14px 0; } .article-body p { font-weight: bold; font-size: 14px; margin: 0 0 clamp(6px, 2vw, 14px) 0; } .article-link { background-color: #fff; border: 1px solid #3b59aa; color: black; text-align: center; text-decoration: none; border-radius: 8px; display: inline-block; font-size: 16px; font-weight: bold; padding: 10px 20px; width: fit-content; } @media (max-width: 600px) { .article-callout { flex-direction: column; align-items: center; } .article-media { max-width: 100%; } .article-media img { border-radius: 8px 8px 0 0; } .article-body { padding: 15px; width: 100%; } .article-link { width: 100%; margin: 0 auto; box-sizing: border-box; } }
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the reportRelated Articles:
Police seize “First VPN” service used in ransomware, data theft attacks
DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act
Hackers arrested over €30M bank fraud exploiting service provider flaw
Police dismantle Kratos phishing platform, arrest developer
New HollowGraph malware uses Microsoft Graph for stealthy C2 comms
Was this article helpful?