US charges 17 Iranians over alleged years-long cyber attack campaign

Seventeen Iranians have been charged by the US Department of Justice (DoJ) for participating in a prolonged cyber attack campaign, allegedly targeting American institutions since 2013. The Mabna Institute, based in Iran, is accused of infiltrating the computer systems of 144 US universities and 42 private sector firms, stealing over 31 terabytes of data and intellectual property worth around $3.4bn (£2.5m).

FBI Assistant Director James C Barnacle Jr termed the coordinated attacks as a "serious threat to our national security". The DoJ stated that many of the attacks were carried out on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC), as well as for other Iranian government and university clients. The operation, backed by the IRGC, aimed to target US institutions and global partners, the DoJ added.

Mabna allegedly compromised the accounts of 100,000 academics worldwide, successfully hacking 8,000 professors' email accounts at the targeted US universities and 178 other institutions globally. The campaign ran from approximately 2013 to December 2017. The DoJ has offered a $10m (£7.3m) reward for information leading to the whereabouts of five of the charged hackers.

US Attorney Jamie McDonald warned of the alarming impact cyber attacks have on US security and the economy, emphasizing that cyber operations have become a central instrument of national power. Besides academic institutions, the Mabna Institute is accused of targeting and compromising email accounts of employees from at least five US federal and state government agencies, as well as 42 US-based private companies and 11 foreign companies in Germany, Italy, Switzerland, Sweden, and the UK. Nine of the 17 charged members were previously indicted in a seven-count indictment in March 2018.