U.S. Indicts and Sanctions 9 Iranians for Cybercrimes for the Islamic Revolutionary Guard Corps
On March 23, 2018, an indictment against nine Iranian nationals was unsealed in the U.S. District Court, Southern District of New York. It charges them as serving as leaders, contractors, associates, hackers-for-hire, and affiliates of the Mabna Institute, an Iran-based company responsible for a coordinated campaign of cyber intrusions starting in at least 2013 into computer systems belonging to 144 U.S.-based universities, 176 universities across 21 foreign countries, 47 domestic and private sector companies, the U.S. Department of Labor, the Federal Energy Regulatory Commission, the State of Hawaii, the State of Indiana, the United Nations, and the U.N. Children’s Fund. The Mabna Institute allegedly used the acts of the defendants to steal over 30 terabytes of academic data and intellectual property from universities, and email in boxes from employees of victim private sector companies, government victims, and non-governmental organizations. The defendants made many of these intrusions on behalf of the Islamic Republic of Iran’s Islamic Revolutionary Guard Corps (“IRGC”), one of several entities within the government of Iran responsible for gathering intelligence, as well as other Iranian government clients. In addition to the criminal charges, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated the Mabna Institute and the nine defendants for sanctions for the malicious cyber-enabled activity discussed in the indictment.