Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute
US re-ups charges against alleged Iranian hackers from Mabna Institute for massive cybertheft.
Federal authorities have unsealed a superseding indictment against 17 Iranians affiliated with the Mabna Institute, expanding on charges from 2018. The Tehran-based firm is accused of a state-sponsored cybertheft campaign targeting universities, governments, and companies worldwide, aiming to steal research and intellectual property on behalf of the Iranian government. The indictment alleges the compromise of over 100,000 professor email accounts globally, including 8,000 at U.S. universities, resulting in the theft of at least 31.5 terabytes of data.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe Mabna Institute campaign succeeded largely because academic institutions failed to enforce strong authentication controls and monitor for credential-based attacks targeting faculty email accounts. Spear-phishing and password spraying against professor accounts granted attackers persistent access to vast repositories of research and intellectual property. The sheer scale — 100,000 compromised accounts across multiple countries — highlights how a single weak authentication layer can expose enormous volumes of sensitive data. This matters because stolen academic and government research has long-term geopolitical and economic consequences that extend well beyond the initial breach.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.