U.S. Charges 17 Iranian Hackers in $6 Million Bitcoin Extortion Scheme

Seventeen Iranian hackers charged in global cyber campaign

The U.S. Justice Department has charged 17 individuals allegedly linked to the Iran-based Mabna Institute for a years-long hacking campaign. The group is accused of targeting hundreds of universities, companies, and government agencies worldwide, including a 2017 breach of HBO.

Prosecutors say the hackers attempted to extort HBO for roughly $6 million in Bitcoin, a type of digital currency that allows secure online payments without a bank. Six of the defendants were directly involved in the HBO hack, according to the charges.

What the charges reveal

• The Mabna Institute allegedly carried out hacks on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC) and other Iranian government clients.
• The group stole at least 31.5 terabytes of academic data and intellectual property from universities and research institutions.
• More than 100,000 professor accounts worldwide were targeted in the campaign.
• Behzad Mesri, previously charged in the HBO hack, was named alongside five other defendants in the new indictment.

Official statements from the Justice Department

Assistant Attorney General for National Security John A. Eisenberg said in a statement: "The superseding indictment alleges that, at the behest of entities including the IRGC, these defendants hacked into universities and other research institutions worldwide, including the United States, stealing at least 31 terabytes of information and intellectual property of untold value."

What is confirmed

• The U.S. Justice Department has formally charged 17 individuals with involvement in the Mabna Institute’s hacking campaign.
• The group targeted HBO in 2017 and attempted to extort $6 million in Bitcoin.
• The hackers stole at least 31.5 terabytes of data from universities and research institutions.
• The campaign was allegedly conducted for Iran’s Islamic Revolutionary Guard Corps and other Iranian government clients.

What remains unclear

• The exact value of the stolen intellectual property has not been disclosed.
• It is unclear whether any of the extorted Bitcoin was successfully recovered.
• The current status of the defendants, including whether they have been arrested, is not confirmed.

Why this case matters

The charges highlight the growing use of cryptocurrency in cybercrime, particularly for extortion. Bitcoin and other digital currencies are often used in ransomware and hacking schemes because they allow transactions to be made anonymously across borders. This case also underscores the risks of state-sponsored cyberattacks targeting intellectual property and sensitive data.

Sources

• Decrypt