DOJ Charges 17 Iranian Hackers Tied to Mabna Institute

DOJ Unseals New and Updated Charges Against 17 Iran-Linked Hackers

The U.S. Department of Justice this week unsealed new and updated charges against 17 individuals the government says are connected to Iran-based hacking operations, and the U.S. State Department's Rewards for Justice program is offering rewards of up to $10 million for information leading to the identification or location of five of the defendants. The Department of Justice (DOJ) is the federal agency responsible for prosecuting crimes under U.S. law, including computer intrusion offenses. Prosecutors say the defendants include individuals tied to the Mabna Institute, an Iran-based company the DOJ has previously described as operating on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC), a branch of Iran's armed forces that the U.S. government has connected to state-directed cyber operations. According to the DOJ's announcement corroborated by public reporting, some of the defendants were previously charged in an earlier case tied to the theft of research, academic, and intellectual property from hundreds of universities, companies, and government agencies in the U.S. and abroad. The updated indictment reportedly adds new defendants, including three Iranian nationals charged separately with computer intrusions and ransomware-style extortion targeting U.S. critical infrastructure operators. Ransomware-style extortion refers to attacks in which intruders access a victim's systems, often threaten to leak or destroy stolen data, and demand payment to prevent that outcome, distinct from run-of-the-mill ransomware in that it may not always involve file encryption.

None of the named defendants are reported to be in U.S. custody, which is why the Rewards for Justice program, a State Department initiative authorized by Congress to offer financial rewards for information on threats to U.S. national security, including state-linked malicious cyber actors, has attached bounties to five of them. Readers should treat the underlying conduct as allegations contained in unsealed federal charging documents; the defendants have not been convicted, and guilt is a matter for the courts to determine.

What This Means For Your Business

Charges like these matter operationally even though most readers will never be directly targeted by a state-linked actor. First, they confirm a pattern federal agencies have flagged repeatedly: credential theft and internet-facing system compromise remain the dominant entry points for both nation-state and financially motivated intruders. According to the DOJ's earlier public statements on the Mabna Institute case, the group's original activity involved stealing login credentials from university faculty and staff through phishing campaigns designed to look like legitimate institutional communications, then using those credentials to access research databases and library systems. That tactic hasn't gone out of style; it is the same technique behind the majority of business email compromise and network intrusion cases small and mid-sized organizations report to the FBI's Internet Crime Complaint Center (IC3) every year.

Second, the addition of critical infrastructure-focused ransomware-style extortion charges signals that Iran-linked actors are not confined to espionage and intellectual property theft. The Cybersecurity and Infrastructure Security Agency (CISA), the federal agency responsible for coordinating cyber defense of U.S. critical infrastructure sectors, has repeatedly warned water utilities, healthcare providers, and other essential services about Iran state-linked exploitation of poorly secured remote access tools and default or reused credentials on internet-exposed operational technology. Healthcare practices, tax and accounting firms, and small businesses that provide services to larger critical infrastructure operators should assume they can be an entry point into a bigger target, even if they don't consider themselves critical infrastructure.

Third, the Rewards for Justice bounty structure is itself a signal worth noting. When the State Department attaches $10 million rewards to named individuals, it usually means the U.S. government assesses those actors as active, capable, and unlikely to be extradited soon, which means the underlying tactics, techniques, and procedures associated with them are likely to remain in use. Treat this less as closure and more as a continued threat advisory.

Practical Steps for Readers

Bellator Cyber Guard recommends the following actions for healthcare practices, tax professionals, small businesses, and security-conscious individuals in response to this disclosure:

• Audit remote access. Confirm that VPNs, RDP, and remote management tools are not exposed directly to the internet without multi-factor authentication (MFA), and disable any unused remote access accounts immediately.
• Enforce MFA everywhere it's supported, especially for email, VPN, and any portal that touches patient, client, or financial records, phishing-derived credential theft remains the most common entry vector in cases like this one.
• Train staff on targeted phishing that impersonates trusted institutional senders, since the original Mabna Institute campaigns reportedly used spoofed university login pages and fake conference invitations.
• Segment critical systems. If your organization operates or supports operational technology (OT), such as building management, medical devices, or utility-adjacent systems, ensure those networks are isolated from general IT and email systems.
• Review third-party access. If you're a vendor to a hospital system, utility, or government agency, confirm your own access credentials are not a weak link that could expose a larger downstream target.
• Report suspected compromise or extortion attempts to the FBI's IC3 (ic3.gov) or your local FBI field office, and to CISA if the affected system supports critical infrastructure services.

These charges won't change the threat landscape overnight, but they confirm that credential-based intrusion and extortion-style pressure tactics tied to Iran state-linked actors remain an active concern for U.S. organizations well beyond the university sector where this story originated in 2018.