US Charges 17 Iranians in Alleged Mabna Cyber-Theft Campaign

Federal prosecutors say the defendants targeted universities, companies and government agencies to steal research, academic records and intellectual property for Iranian clients.

WASHINGTON, UNITED STATES —  US prosecutors have charged 17 Iranian nationals in an alleged cyber-theft campaign tied to the Iran-based Mabna Institute, accusing the group of targeting universities, businesses, government agencies and other organizations to obtain research, academic data and intellectual property.

The Justice Department announced the charges Tuesday, saying the alleged activity was conducted on behalf of Iran’s Islamic Revolutionary Guard Corps and other Iranian entities. Nine of the defendants had been charged in an earlier 2018 case, while the new filings expand the government’s account of the operation.

The allegations are criminal accusations. None of the defendants should be described as guilty unless and until that is established through a court process.

According to the Justice Department, Mabna-linked hackers used credential theft and other intrusion techniques to access systems belonging to hundreds of universities and other victims. The department says more than 31 terabytes of academic data, proprietary information and intellectual property were stolen over the course of the campaign.

Universities were a central target

Academic institutions hold unusually valuable combinations of information: unpublished research, specialized databases, intellectual property and credentials that can provide access to journals and other subscription services. They also support large, decentralized user populations, which can make phishing campaigns effective.

The US government’s allegations against Mabna are not new. In 2018, the Justice Department charged nine Iranian nationals and said the operation had targeted professors at universities in the United States and abroad. The Treasury Department also sanctioned Mabna and described it as a network conducting intrusions for the IRGC.

Tuesday’s action broadens the group of defendants and updates the government’s description of the alleged victims and stolen material.

The case remains largely an attribution challenge

Cybercrime prosecutions involving defendants outside the United States often face a practical obstacle: an indictment can identify alleged actors and expose methods without producing an immediate arrest. The Justice Department did not announce that the full group of defendants was in US custody.

That makes the case as much about public attribution and disruption as courtroom proceedings. Naming alleged operators can limit their ability to travel, work with international companies or operate under previously useful identities. Sanctions and reward programs can add further pressure.

But public attribution also requires care. The Justice Department’s account is supported by investigative material that prosecutors say underlies the charges, yet the defense has not been tested at trial. The claims about who directed the hackers and who ultimately benefited from stolen information remain allegations unless proven.

The case also shows why universities have become recurring targets in state-linked cyber operations. Research institutions connect government-funded science, private-sector partnerships and global academic networks, making compromised credentials useful far beyond one campus.

The next verified developments would include arrests, extradition proceedings, court appearances or additional sanctions. Until then, the indictment establishes the government’s allegations, not a final finding of criminal responsibility.

By Marcus Reed | Crime & Public Safety | CRN Times
Published: 18 August 2026, 2:45 p.m.