U.S. Charges 17 Iranians in Major Cyber Theft Campaign Including $6M Bitcoin Ransom

17 Iranians Charged in Large-Scale Cyber Theft Operation

The U.S. Department of Justice has charged 17 Iranian nationals for their alleged involvement in a years-long cyber theft campaign. The hackers targeted hundreds of universities, companies, and government agencies, including an attempt to extort $6 million in Bitcoin from HBO.

The charges were announced on August 20, 2026, and involve individuals linked to the Mabna Institute, an organization accused of working with Iran’s Islamic Revolutionary Guard Corps.

Key Details of the Hacking Campaign

• The hackers targeted over 300 universities worldwide, dozens of companies, and at least five U.S. government agencies.
• One of the defendants, Behzad Mesri, previously tried to extort HBO for approximately $6 million in Bitcoin after stealing proprietary data.
• The U.S. government is offering a $10 million reward for information leading to the defendants' whereabouts.
• The stolen research and data were allegedly resold through websites like Megapaper.ir and Gigapaper.ir.
• U.S. institutions spent $3.4 billion acquiring the stolen materials, while victims incurred over $20 million in cleanup costs.

What the U.S. Department of Justice Announced

The Department of Justice stated that the Mabna Institute, founded around 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, carried out the hacking campaigns on behalf of Iran’s Islamic Revolutionary Guard Corps and other Iranian clients. The stolen data included research and intellectual property from American universities and businesses.

U.S. Attorney Jamie McDonald for the Southern District of New York said, “Today’s charges reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property.”

What Is Confirmed

• The U.S. Department of Justice has formally charged 17 Iranian nationals.
• The charges include involvement in a cyber theft campaign targeting universities, companies, and government agencies.
• Behzad Mesri was previously charged with attempting to extort HBO for $6 million in Bitcoin.
• A $10 million reward is being offered for information on the defendants.
• The Mabna Institute is accused of working with Iran’s Islamic Revolutionary Guard Corps.

What Is Still Unclear

• The current whereabouts of the 17 defendants are unknown.
• It is unclear whether any of the stolen Bitcoin has been recovered.
• The full extent of the data stolen from government agencies remains undisclosed.

Why This Case Matters

This case highlights the growing threat of state-sponsored cyber attacks targeting intellectual property and sensitive data. The use of Bitcoin in ransom demands also shows how cryptocurrencies, which allow for direct and often anonymous transactions, are increasingly used in cybercrime.

The charges underscore the U.S. government’s efforts to hold foreign hackers accountable for cyber theft and extortion.

Sources

• Bitcoin Magazine
• U.S. Department of Justice