Adversary Intelligence — 2026-08-20

US Charges 17 Iranians Linked to IRGC Mabna Institute in Expanded Global Hacking Indictment

BLUFExpanding the Mabna indictment signals sustained U.S. willingness to name IRGC cyber contractors but does nothing to disrupt the outsourced espionage model those contractors serve.

The Justice Department unsealed a superseding indictment charging 17 Iranians tied to Iran's Mabna Institute with running an IRGC-backed hacking campaign, adding eight defendants to the nine charged in 2018 12. Prosecutors said the group targeted more than 100,000 academic accounts, compromised about 8,000 of them, and stole at least 31 terabytes of research and intellectual property 12. OCCRP cited 322 breached universities plus companies, U.S. agencies, the UN and UNICEF 1; Cybersecurity Dive, citing DOJ, put the toll at 144 U.S. universities, 42 companies and at least five federal and state agencies 2. The State Department is offering rewards of up to $10 million for the location of five defendants, including Behzad Mesri, previously charged in 2017 over the HBO "Game of Thrones" extortion attempt 12.

Analysis
The expanded Mabna indictment functions as attribution and deterrence rather than prosecution: Tehran has surrendered no IRGC-linked cyber defendant across eight years the original case has stood open, and the reward offer likely constrains the five listed defendants, including Mesri, to travel outside U.S. extradition jurisdictions rather than forcing custody. Sourcing rests on the original DOJ release, with OCCRP and Cybersecurity Dive restating its figures rather than independently corroborating them. Post-unsealing reporting narrows the victim count to 144 U.S. universities, 42 companies and five federal or state agencies against OCCRP's broader 322-institution figure, and ties Mabna's infrastructure to the tracked Silent Librarian, Cobalt Dickens and TA407 clusters. The disclosure recasts Mabna as a contractor monetizing research for the IRGC as anchor client, implying similarly structured networks serving other IRGC-adjacent clients remain unaccounted for in university security postures.

3 sources

US Charges Eight More Iranians in Global Hacking Case - OCCRP
DOJ charges 17 people in Iran-backed hacking campaign against US - Cybersecurity Dive
17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities - U.S. Department of Justice, Office of Public Affairs