[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ_PlAW8HckE6V29vKhB60gk4iUew1q_9QCLp0zjb-yM":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"eaaf4fbe-8792-47d8-a52b-a6de72eb519e","Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute","eight-years-later-federal-authorities-re-up-charges-against-alleged-iranian-hack-b38c5c","The superseding indictment adds defendants and allegations against the Iranian firm accused of a massive cybertheft campaign against foreign universities and others. The post Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute appeared first on CyberScoop.","Federal authorities have unsealed a superseding indictment against 17 Iranians affiliated with the Mabna Institute, expanding on charges from 2018. The Tehran-based firm is accused of a state-sponsored cybertheft campaign targeting universities, governments, and companies worldwide, aiming to steal research and intellectual property on behalf of the Iranian government. The indictment alleges the compromise of over 100,000 professor email accounts globally, including 8,000 at U.S. universities, resulting in the theft of at least 31.5 terabytes of data.","US re-ups charges against alleged Iranian hackers from Mabna Institute for massive cybertheft.","https:\u002F\u002Fcyberscoop.com\u002Fmabna-institute-iranian-hackers-indictment\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F08\u002FGettyImages-2252191885.jpg","2026-08-18T20:12:06+00:00","2026-08-18T22:00:22.723122+00:00",8,[17],{"name":18,"type":19},"Mabna Institute","threat_actor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":20,"icon":22,"name":23,"slug":24},null,"Nation-state","nation-state",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":41,"vendors":126},[42,71,100],{"slug":43,"name":44,"problem":45,"products":46},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":72,"name":73,"problem":74,"products":75},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":122,"product_name":123,"url":124,"description":125},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":143},"state-sponsored-iranian-hackers-stole-315tb-from-100000-academic-accounts","State-Sponsored Iranian Hackers Stole 31.5TB from 100,000+ Academic Accounts","The Mabna Institute campaign succeeded largely because academic institutions failed to enforce strong authentication controls and monitor for credential-based attacks targeting faculty email accounts. Spear-phishing and password spraying against professor accounts granted attackers persistent access to vast repositories of research and intellectual property. The sheer scale — 100,000 compromised accounts across multiple countries — highlights how a single weak authentication layer can expose enormous volumes of sensitive data. This matters because stolen academic and government research has long-term geopolitical and economic consequences that extend well beyond the initial breach.",[132,133,134,135,136,137,138,139,140,141,142],"CIS Control 4 - Controlled Use of Administrative Privileges","CIS Control 6 - Access Control Management","CIS Control 14 - Security Awareness and Skills Training","CIS Control 13 - Network Data Protection","NIST SP 800-171 3.5.3 - Multi-Factor Authentication","NIST AC-2 - Account Management","NIST AC-17 - Remote Access","NIST SI-4 - System Monitoring","NIST SP 800-53 IA-5 - Authenticator Management","GDPR Article 32 - Security of Processing","FERPA - Protection of Student and Research Records",{}]