An article fromDOJ charges 17 in Iran-backed hacking campaign against US colleges, others

Officials allege the Mabna Institute was behind an effort to steal research from American universities, companies and government agencies.

Published Aug. 20, 2026David Jones Reporter

• Share
  • Copy link
  • Email
  • LinkedIn
  • X/Twitter
  • Facebook
  • Print
• License
• Add us on Google

The U.S. Department of Justice building, in Washington, D.C. Federal prosecutors on Aug. 18, 2026, announced charges against 17 people allegedly behind a multiyear campaign to steal intellectual property and other sensitive information from American universities, companies and government agencies. Yin Yang via Getty Images

First published on

The U.S. Department of Justice on Tuesday announced indictments against 17 members of the Mabna Institute, an Iranian organization alleged to be behind a coordinated cyberattack campaign on behalf of the Islamic Revolutionary Guard Corps. 

Federal prosecutors said the group allegedly hacked into 144 U.S.-based universities, 42 U.S.-based private sector companies and at least five federal and state agencies, as well as a large number of foreign universities and companies, since 2013. 

The charges reveal a broader effort behind a “sweeping state-sponsored campaign to steal research and intellectual property from American universities, businesses and government institutions,” Jamie McDonald, U.S. Attorney for the Southern District of New York, said in a statement.

Prosecutors allege more than 100,000 accounts of professors were targeted by the alleged hackers, and 8,000 of those accounts were successfully compromised.

if (window.dfp_visibility === 'mobile' ) googletag.cmd.push(function() googletag.defineSlot( '/3618/highereddive/highereddivehybrid1', [[300, 250], 'fluid'], 'dfp-hybrid1-mobile' ).addService(googletag.pubads()); ); waitToLoadAds.push(function() googletag.cmd.push(function() if (window.dfp_visibility === 'mobile' ) window.onDvtagReady?.(() => googletag.display('dfp-hybrid1-mobile')); googletag.pubads().addEventListener('slotRenderEnded', function (event) var adUnitPath = '/3618/highereddive/highereddivehybrid1'; var onProformative = false; if (onProformative && event.slot.getAdUnitPath() === adUnitPath && !event.isEmpty ) var adUnitPathWithVisibility = adUnitPath + '-mobile'; var selector = '.pf-comments__ad-wrapper #dfp-hybrid1-mobile'; if (!$(selector).closest('.pf-comments__ad-wrapper').hasClass('borders')) $(selector).closest('.pf-comments__ad-wrapper').addClass('borders') ); ); ); if (window.dfp_visibility === 'desktop' ) googletag.cmd.push(function() googletag.defineSlot( '/3618/highereddive/highereddivehybrid2', [[300, 250], 'fluid'], 'dfp-hybrid2-desktop' ).addService(googletag.pubads()); ); waitToLoadAds.push(function() googletag.cmd.push(function() if (window.dfp_visibility === 'desktop' ) window.onDvtagReady?.(() => googletag.display('dfp-hybrid2-desktop')); googletag.pubads().addEventListener('slotRenderEnded', function (event) var adUnitPath = '/3618/highereddive/highereddivehybrid2'; var onProformative = false; if (onProformative && event.slot.getAdUnitPath() === adUnitPath && !event.isEmpty ) var adUnitPathWithVisibility = adUnitPath + '-desktop'; var selector = '.pf-comments__ad-wrapper #dfp-hybrid2-desktop'; if (!$(selector).closest('.pf-comments__ad-wrapper').hasClass('borders')) $(selector).closest('.pf-comments__ad-wrapper').addClass('borders') ); ); );

In all, the attackers stole more than 31TB of academic data and intellectual property from various universities and broke into employee email accounts at universities, private companies and government agencies. 

The charges are part of a superseding indictment that originated against the Mabna Institute eight years ago. Nine of the 17 defendants were part of a seven-count indictment unsealed in the 2018 case.  

Mabna has been tracked for years under the names Silent Librarian, Cobalt Dickens or TA407. Researchers at Sophos and Proofpoint linked the group to years of social engineering and phishing activity, often using stolen university branding or library-themed phishing emails.

“Mabna represents the privatization of state espionage: a contractor selling stolen research to whoever's paying, with the IRGC as an anchor client rather than a sole owner,” Shmuel Gihon, security research team lead, exposure management at Check Point Software, told Cybersecurity Dive.

The defendants previously targeted various government agencies, including the U.S. Department of Labor and Federal Energy Regulatory Commission, the states of Hawaii and Indiana, as well as the United Nations, according to the DOJ.

The defendants also targeted Home Box Office in the hacking campaign. One of the defendants, Behzad Mesri, was charged in 2017 with attempting to extort the company for $6 million in bitcoin in connection with the hack of unaired episodes of the HBO series “Game of Thrones.”

Iran war rages on

The charges come amid an investigation into a coordinated hack of water systems in 12 U.S. states. No charges have been filed in that case, but federal and state investigators linked the incidents to recent cyberattacks targeting industrial devices that monitor water systems. 

The U.S. has been at war with Iran since launching a bombing campaign with Israel in late February. 

The State Department is offering a $10 million reward for information leading to the location of five of the defendants, including Mesri.

• Add us on Google
• Share
  • Copy link
  • Email
  • LinkedIn
  • X/Twitter
  • Facebook
  • Print
  • License

Filed Under: Technology Higher Ed Dive news delivered to your inbox

Get the free daily newsletter read by industry experts

Email:

• Select user consent: By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at anytime.

Sign up A valid email address is required. Please select at least one newsletter.Editors' picks

• The image by Ken Lund is licensed under CC BY 2.0Michigan State faculty vote no confidence in board after leadership turmoil

  The vote, which overwhelmingly passed, followed complaints of trustee infighting and President Kevin Guskiewicz rolling back his decision to leave.

  By Ben Unglesbee • July 16, 2026
• Getty ImagesTemple University lays off 40 employees as it tackles deficit

  The public Philadelphia institution is reducing its workforce for the second year in a row but has seen promising enrollment gains of late.

  By Ben Unglesbee • July 10, 2026