[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7-slDjkBxfq9DA-BW-81lSHSUSsq59jEdNu82bZkLYc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"9d7872c8-988d-420a-9d5c-d417815a3e9a","state-sponsored-iranian-hackers-stole-315tb-from-100000-academic-accounts","eaaf4fbe-8792-47d8-a52b-a6de72eb519e","State-Sponsored Iranian Hackers Stole 31.5TB from 100,000+ Academic Accounts","The Mabna Institute campaign succeeded largely because academic institutions failed to enforce strong authentication controls and monitor for credential-based attacks targeting faculty email accounts. Spear-phishing and password spraying against professor accounts granted attackers persistent access to vast repositories of research and intellectual property. The sheer scale — 100,000 compromised accounts across multiple countries — highlights how a single weak authentication layer can expose enormous volumes of sensitive data. This matters because stolen academic and government research has long-term geopolitical and economic consequences that extend well beyond the initial breach.","**Immediate actions:**\n- Enforce multi-factor authentication (MFA) on all faculty, staff, and student email accounts without exception.\n- Audit and disable dormant or unused accounts that represent unnecessary attack surface.\n\n**Long-term improvements:**\n- Implement a Data Loss Prevention (DLP) solution to detect and block large-scale exfiltration of research data and intellectual property.\n- Classify sensitive research data and apply role-based access controls so only authorized personnel can access high-value datasets.\n- Establish a security awareness training program specifically tailored to phishing threats targeting academic researchers.\n\n**Detection measures:**\n- Deploy behavioral analytics and SIEM rules to flag anomalous login patterns such as impossible travel, credential stuffing, or bulk email access.\n- Monitor and alert on large outbound data transfers exceeding baseline thresholds for any user or department.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 4 - Controlled Use of Administrative Privileges","CIS Control 6 - Access Control Management","CIS Control 14 - Security Awareness and Skills Training","CIS Control 13 - Network Data Protection","NIST SP 800-171 3.5.3 - Multi-Factor Authentication","NIST AC-2 - Account Management","NIST AC-17 - Remote Access","NIST SI-4 - System Monitoring","NIST SP 800-53 IA-5 - Authenticator Management","GDPR Article 32 - Security of Processing","FERPA - Protection of Student and Research Records",{},"published","2026-08-18T22:20:52.005621+00:00","2026-08-18T22:20:51.905+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fcyberscoop.com\u002Fmabna-institute-iranian-hackers-indictment\u002F","eight-years-later-federal-authorities-re-up-charges-against-alleged-iranian-hack-b38c5c","Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[52,56,60],{"slug":53,"name":54,"problem":55},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":57,"name":58,"problem":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":61,"name":62,"problem":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]