As reported by SecurityAffairs, the US Department of Justice has unsealed a superseding indictment adding eight new defendants to the years-old case against the Iran-based Mabna Institute, bringing the total charged to 17. The operation—active since at least 2013 and conducted on behalf of the Islamic Revolutionary Guard Corps—compromised hundreds of universities, dozens of companies, and multiple government agencies, exfiltrating more than 31 terabytes of academic data and intellectual property. The inclusion of Behzad Mesri, previously indicted separately for the HBO extortion attempt, now formally ties that headline incident into the broader Mabna apparatus.

Threat Intelligence: As reported by SecurityAffairs, the US Department of Justice has unsealed a superseding indictment adding eight new defendants to the years-old case against the Iran-based Mabna Institute, bringing the total charged to 17.

What Makes This Case Distinctive

State-sponsored intellectual property theft is not new. What sets the Mabna Institute operation apart is the deliberate commercialization layer. The group didn't just steal research for state consumption—it built customer-facing platforms (Megapaper.ir, Gigapaper.ir) that resold access to compromised professor accounts and piloted academic literature. This is espionage-as-a-service with a revenue stream, and it operated openly enough to maintain public-facing websites.

The targeting of over 100,000 professor accounts across 24 countries, with roughly 8,000 successful compromises, demonstrates a credential abuse operation at a scale that most academic institutions are still not equipped to detect.
The superseding indictment also illustrates a pattern defenders should note: these actors relied heavily on credential theft and reuse rather than zero-day exploits or novel malware. The technical sophistication was moderate; the operational persistence and scale were the differentiators.

Who Remains at Risk

What Makes This Case Distinctive
Academic institutions — Universities remain priority targets for intellectual property theft because their access controls, federated identity systems, and open research culture create a wide attack surface. Professor accounts often carry subscription access to expensive journal databases, making them doubly valuable.
Private sector R&D organizations — The 42 US companies and 11 foreign companies compromised in this campaign signal that any organization holding proprietary research is a viable target for similar actor sets.
Government agencies and NGOs — Five federal/state agencies and two NGOs were compromised, underscoring that these actors cast wide nets rather than narrowly targeting classified systems.

Broader Implications

The eight-year gap between the original 2018 indictment and this superseding filing demonstrates both the patience of US prosecutors and the difficulty of dismantling operations sheltered by adversarial states. The defendants remain outside US jurisdiction, meaning the indictments serve primarily as naming-and-shaming tools, travel restrictions, and deterrent signals rather than mechanisms for immediate disruption.

The connection to the HBO extortion through Behzad Mesri is significant. It suggests that actors operating within state-directed ecosystems also pursued independent criminal monetization opportunities. This convergence of state sponsorship and personal profit motive complicates attribution and means defenders cannot assume these actors will stay within their mission scope.

Shield53 Recommendations

  • Enforce phishing-resistant MFA on all academic and research accounts. The Mabna campaign relied on credential theft; FIDO2/WebAuthn keys or platform authenticators would have disrupted the majority of compromises described.
  • Implement credential monitoring — subscribe to services that flag exposed credentials for faculty and research staff. The 100,000+ targeted accounts likely included credentials already circulating from prior breaches.
  • Monitor for anomalous access patterns in library and journal subscription systems. Logins from unexpected geographies, mass download of full-text articles, and concurrent sessions on single accounts are indicators that would have surfaced this activity.
  • Conduct regular reviews of federated identity trust relationships. Compromised credentials at one institution can provide access to shared resources across federated networks like InCommon or eduGAIN.
  • Brief research faculty on credential phishing specifically. Generic security awareness training is insufficient; faculty need to understand that their accounts are targets because of the subscription access and research data they unlock, not just their personal information.
  • Hunt for historical compromise. If your organization was in the targeting profile during the 2013–2018 window, assume you may have been accessed. Review archived authentication logs, email forwarding rules, and outbound data transfer records.

The Mabna Institute case is a reminder that the most damaging state-sponsored operations are often the least technically sophisticated. Persistent credential abuse at scale, conducted over years, can extract more value than a single zero-day. Defenders who focus exclusively on advanced malware detection while neglecting identity hygiene are leaving the door open that actors like these have been walking through for over a decade.