Mabna Institute case re-upped with 17 defendants, this time during a war with Iran

Federal prosecutors on Tuesday unsealed an indictment charging 17 Iranians affiliated with the Tehran-based Mabna Institute over what they describe as a state-sponsored campaign to steal research and intellectual property from American universities, businesses and government institutions ^[1]. The filing replaces and expands a 2018 indictment that named nine of the same defendants ^[2], and according to CyberScoop it arrives while the United States is waging a war against Iran, after a 60-day negotiation deadline recently passed with no progress ^[3].

Eight names are new ^[4][1]. Jamie McDonald, the U.S. Attorney for the Southern District of New York, said the additional defendants "reveal the broader network allegedly behind a sweeping, state-sponsored campaign" and that "the passage of time will not deter us from identifying and pursuing those who target the United States from abroad" ^[4][5]. McDonald also framed the case in strategic rather than criminal terms, saying cyber operations "have become a central instrument of national power" and that attacks on American and allied institutions carry direct consequences for security and economic strength ^[6].

The alleged mechanics are unglamorous and durable. The Justice Department says Gholamreza Rafatnejad and Ehsan Mohammadi founded Mabna around 2013 to help Iranian universities and scientific and research organisations take from foreign scientific efforts, and that it paid hackers-for-hire named in the indictment ^[7][8]. The indictment alleges compromise of more than 100,000 professors' email accounts globally, and 8,000 successfully compromised accounts at 144 U.S. universities and 178 universities elsewhere ^[9][10] - 322 institutions in total ^[2]. Those two figures sit awkwardly together in the government's own account, and the smaller one is the number tied to named institutions.

With stolen credentials, the defendants are alleged to have taken academic journals, dissertations and e-books across all fields, at least 31.5 terabytes, and to have sold stolen data at times ^[11][12]. The Justice Department's valuation is not a damages estimate but a procurement figure: U.S.-based universities spent more than approximately $3.4 billion over the course of the conspiracy to procure and access such data and intellectual property ^[13]. Beyond academia, the indictment alleges theft from email accounts at a minimum of five U.S. federal and state government agencies, 42 U.S. companies and 11 foreign companies, including HBO ^[14]. It brings 14 separate, sometimes overlapping charges carrying sentences from two to 20 years ^[15].

The enforcement reality is visible in the accompanying reward. The State Department's Rewards for Justice programme is offering up to $10 million for information leading to the location of four of the defendants ^[16], which is not something you offer for people in custody. What the re-indictment does deliver is a statement of posture: after more than eight years, the government is describing library credential theft against universities as a live instrument of Iranian state power rather than a closed case from a previous decade ^[5][6].

Two things to watch. First, whether the eight new names produce any information under the reward offer, or whether the case stays a paper action against defendants beyond reach ^[16]. Second, the exposure this creates for research institutions themselves: the sector was already the primary target set described in the indictment ^[1][9], and prosecutors have now named individuals during an active war ^[3]. University security teams should assume professor mailboxes and journal access credentials remain the intended door, because that is what the indictment says worked ^[10][11].