Actor Profile

Mabna Institute is an Iranian hacking-for-hire organization linked to cyber operations conducted on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC), other Iranian government bodies, universities, and private paying customers. The group consists of at least 17 Iranian nationals charged by U.S. authorities for conducting a years-long campaign beginning around 2013 that targeted academic institutions, private companies, and government agencies worldwide. The actor operates as a contractor providing cyber espionage services to state and non-state clients, focusing on large-scale credential theft and intellectual property exfiltration. Nine members were initially indicted in March 2018, with eight additional defendants charged in August 2026, reflecting the expanded scope of attribution efforts.

TTPs (Tactics, Techniques, Procedures)

Mabna Institute's operations centered on credential-based initial access, targeting over 100,000 professor accounts globally and successfully compromising approximately 8,000. The group employed spearphishing and credential harvesting techniques to gain unauthorized access to academic and corporate networks. Post-compromise, the actors exfiltrated massive volumes of data—31.5 terabytes of academic research including journals, theses, dissertations, ebooks, and proprietary information across multiple disciplines. The campaign also included extortion operations, exemplified by the HBO breach where attackers demanded $6 million in Bitcoin. The operation demonstrates persistent access maintenance and systematic data theft over multiple years, consistent with state-sponsored espionage objectives focused on intellectual property acquisition.

Targets & Patterns

Mabna Institute targeted a broad range of victims across academic, commercial, and government sectors. The campaign impacted 178 universities (144 in the U.S.), at least 53 private firms (42 in the U.S.), two NGOs, and at least 10 U.S. state agencies. The targeting pattern reflects a strategic focus on institutions holding valuable intellectual property and research data. The selection of over 100,000 professors worldwide as initial targets indicates the group prioritized academic credentials as an access vector to research repositories and collaborative networks. High-profile victims included HBO, which was subjected to extortion. The geographic concentration on U.S. institutions, combined with global targeting, suggests intelligence collection priorities aligned with Iranian state interests in acquiring Western academic research, technological innovation, and proprietary business information valued at approximately $3.4 billion.

Historical Context

The Mabna Institute campaign represents one of the most extensive academic espionage operations publicly attributed to Iranian actors. The initial indictment in March 2018 charged nine individuals for intrusions affecting more than 300 universities and private companies. The August 2026 superseding charges added eight defendants, expanding the scope to 17 total individuals and revealing the broader organizational network behind the operation. The campaign's timeline extends from approximately 2013 through at least 2018, demonstrating sustained operational tempo over multiple years. The U.S. government's continued pursuit more than eight years after the original public indictment, coupled with $10 million rewards for five defendants (Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh), underscores the significance of the operation and ongoing efforts to hold state-sponsored actors accountable despite jurisdictional challenges.

Defensive Recommendations

  • Implement multi-factor authentication (MFA) for all academic and research accounts, particularly those with access to intellectual property repositories, to mitigate credential-based initial access
  • Deploy email security solutions with advanced phishing detection capabilities to identify and block spearphishing attempts targeting faculty and researchers
  • Monitor for anomalous data exfiltration patterns, particularly large-volume transfers from research databases, document repositories, and email systems
  • Establish baseline behavioral analytics for privileged accounts to detect unauthorized access using compromised credentials, focusing on access from unusual geolocations or at atypical times
  • Conduct regular security awareness training for academic staff emphasizing credential protection, phishing recognition, and reporting suspicious authentication attempts or account activity

---

# Geopolitical Context

Geopolitical Context

The indictment of 17 Iranian nationals linked to the Mabna Institute represents a continuation of U.S. efforts to publicly attribute and sanction cyber operations allegedly conducted on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC) and other state entities. The campaign, which reportedly began around 2013 and targeted over 100,000 academic accounts globally, appears consistent with Iran's documented interest in acquiring Western research and technology to offset the effects of international sanctions and advance domestic capabilities. The operation's scale—affecting 178 universities (144 in the U.S.), dozens of private firms, and state agencies—underscores the strategic value Tehran places on academic and commercial intellectual property. The eight-year gap between the initial 2018 indictment and these expanded charges reflects both the complexity of cyber attribution and Washington's sustained focus on Iranian cyber activity, particularly operations linked to the IRGC. The $10 million rewards offered for five defendants signal heightened U.S. prioritization of accountability for state-sponsored cyber intrusions.

State Actor Alignment

The defendants are alleged to have operated on behalf of the Islamic Revolutionary Guard Corps (IRGC), other Iranian government bodies, and paying customers, indicating a nexus between state-directed espionage and commercial hacking-for-hire services. This blurred line between state and criminal activity is characteristic of Iran's cyber ecosystem, where contractors and semi-independent entities conduct operations aligned with strategic state interests while also pursuing financial gain. The IRGC's involvement is particularly significant given its designation as a Foreign Terrorist Organization by the United States, which adds additional legal and diplomatic weight to the charges. The indictment does not allege direct Iranian government coordination in all instances, but the targeting priorities—academic research, proprietary technology, and government data—align closely with Iran's known intelligence collection requirements. The U.S. response, including criminal charges, public attribution, and financial rewards, represents a multi-layered approach combining law enforcement, diplomatic signaling, and deterrence messaging directed at Tehran.

Business Impacty pro region

While the operation primarily targeted U.S. institutions (144 universities, 42 private firms, 10 state agencies), the global scope—affecting over 100,000 professors worldwide and 34 non-U.S. universities—suggests Iran's intellectual property collection extends beyond bilateral U.S.-Iran tensions. European, Asian, and other Western research institutions likely featured among the international victims, raising concerns about the security of collaborative research networks and the vulnerability of academic credentials across allied nations. The case may prompt renewed transatlantic coordination on countering Iranian cyber operations and protecting research infrastructure, particularly in sensitive technology domains. For Middle Eastern states, the indictment reinforces perceptions of Iran's asymmetric capabilities and willingness to conduct sustained espionage campaigns despite international pressure. The $3.4 billion valuation, while difficult to verify, frames the operation as one of the largest intellectual property thefts attributed to a state actor, potentially influencing how allies assess risk-sharing in research partnerships and technology transfer agreements.

Forecast

If the U.S. continues to prioritize public attribution and criminal charges against Iranian cyber actors, Tehran is likely to maintain operational security improvements while sustaining intelligence collection against Western academic and commercial targets through alternative infrastructure and personas. Should the $10 million rewards yield actionable intelligence or result in arrests, Iran may recalibrate its use of identifiable contractors in favor of more compartmented operations. If European or other allied institutions recognize themselves among the unnamed victims, multilateral pressure on Iran regarding cyber norms may increase, though enforcement mechanisms remain limited absent broader diplomatic engagement. The case is unlikely to deter Iranian cyber operations in the near term, as the defendants remain outside U.S. jurisdiction and Tehran views intellectual property acquisition as strategically essential. However, if financial institutions or technology providers increase scrutiny of Iranian-linked entities based on this indictment, operational costs for similar campaigns may rise, potentially affecting scope or targeting in future operations.