US authorities have intensified their crackdown on a hacking network linked to Iran by expanding an ongoing case to include 17 defendants. The revised indictment connects these individuals to extensive cyber intrusions targeting academic institutions, government entities, private companies, and notably the 2017 HBO breach that involved a multimillion-dollar Bitcoin ransom attempt.
The group, identified as Mabna Institute, allegedly operated as a private cybersecurity front for Iran’s Islamic Revolutionary Guard Corps (IRGC) and other Iranian clients. Prosecutors claim Mabna compromised approximately 8,000 academic accounts, stealing over 31 terabytes of data and triggering remediation costs exceeding $20 million. The indictment details a wide-ranging campaign that targeted more than 100,000 professor accounts across various universities before concluding major activity by the end of 2017.
Among the six newly added defendants are individuals accused of orchestrating the cyberattack against HBO, where hackers demanded a ransom initially set at $5.5 million, later rising to about $6 million in Bitcoin. The attackers gained access to unreleased TV episodes, scripts, and proprietary materials, which they leaked when the ransom went unpaid. Previously, one defendant, Behzad Mesri, had faced separate charges for this HBO intrusion, but the new filing integrates this incident into the larger Mabna investigation.
Beyond HBO, the indictment accuses some defendants of targeting government and private organizations, leading to significant investigation and mitigation expenses. In parallel with the expanded charges, the US State Department’s Rewards for Justice program offered rewards of up to $10 million for information on key suspects’ whereabouts, including Mesri and others implicated in the cyber campaigns.