DOJ Charges 17 Iranians Tied to IRGC in Long-Running University and Corporate Hacking Campaign

The Justice Department unsealed a 14-count superseding indictment on Tuesday, August 18, charging 17 Iranians with running a years-long cyber theft operation on behalf of Iran's Islamic Revolutionary Guard Corps and other state entities. The indictment expands a 2018 case that originally named nine defendants tied to the Tehran-based Mabna Institute.

Eight new defendants got added this time. Prosecutors say the group compromised roughly 8,000 professor email accounts at 144 U.S. universities and 178 foreign universities, out of more than 100,000 professor accounts targeted worldwide, according to CyberScoop and the Justice Department's own release.

Investigators say the hackers stole at least 31.5 terabytes of academic data, including journals, dissertations and e-books across science, engineering, medicine and social sciences. U.S. universities spent an estimated $3.4 billion procuring and accessing that stolen material in the first place, according to the Justice Department press release cited by CyberScoop and JNS.

Jamie McDonald, the U.S. Attorney for the Southern District of New York, said: "Today's charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions." He added that "more than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad."

The HBO Extortion Angle

One of the more colorful threads in the indictment involves Home Box Office. Behzad Mesri, also known by the alias Skote Vahshat, allegedly hacked HBO's systems in 2017 alongside five co-defendants, stole proprietary data, and tried to extort the company for roughly $6 million in Bitcoin, according to The National and JNS. Mesri remains a fugitive.

Beyond entertainment, the indictment lists victims including the Department of Labor, the Federal Energy Regulatory Commission, and the United Nations, according to CNN. FBI Assistant Director in Charge James C. Barnacle Jr. said "backed by the IRGC, this operation reflects a broader, organized effort to target U.S. institutions and global partners."

Fugitives and Bounties

Five defendants—Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz and Saber Shahbazi Ballojeh—are the subject of a State Department Rewards for Justice offer of up to $10 million for information leading to their location, according to JNS. None of the 17 are in U.S. custody. This is standard practice with Iran-based hacking indictments: no extradition treaty, no realistic path to an arrest unless someone travels somewhere with a U.S. ally.

Assistant Attorney General for National Security John A. Eisenberg said the defendants "hacked into universities and other research institutions worldwide" at the behest of entities including the IRGC.

This indictment isn't landing in a vacuum. CyberScoop and CNN both note the U.S. and Iran have been in an active military conflict since late February, and CyberScoop specifically points out that a 60-day negotiation deadline "recently passed with no progress." The National reports Iranian-linked hackers have also been blamed for attacks on U.S. water infrastructure and for breaching the personal accounts of FBI Director Kash Patel back in March.

The question critics of aggressive cyber-indictment strategy raise is straightforward: charging people who will never see a U.S. courtroom is largely symbolic. It doesn't stop the next intrusion. It doesn't recover the $3.4 billion universities already spent. What it does is create a public paper trail, name specific operatives, and trigger sanctions and financial restrictions that make travel and banking harder for the people named. The Treasury Department has already sanctioned Iranian crypto exchanges like Nobitex in a related effort to choke off funding channels, according to Breitbart.

Coverage Differences

CNN's headline says the DOJ charged "eight Iranians," focusing narrowly on the newly added defendants, while the Epoch Times, JNS and CyberScoop all frame it as 17 total defendants facing charges under the superseding indictment. Both framings are technically accurate, but CNN's emphasis on only the new eight undersells the scope of the total case against the full Mabna Institute network. JNS is alone among these sources in flagging that Israeli universities were among the international targets.

None of the sources indicate any of the 17 have been apprehended or arraigned. The next real test is whether financial sanctions, travel restrictions, and the $10 million bounties actually push any of these five wanted men into a jurisdiction where the U.S. can act, something that hasn't happened with the nine defendants named back in 2018.