US Expands Iran-Linked Mabna Case to 17 Defendants

U.S. prosecutors unsealed a 14-count second superseding indictment on Aug. 18 that raises the number of defendants in the Mabna Institute case to 17. The filing adds eight individuals to a prosecution first brought in 2018 and links six of the new defendants to a 2017 intrusion of HBO.

The indictment names Behzad Mesri, Saeid Houshyar, Manouchehr Hashemloo, Keyvan Fayaz, Saber Shahbazi Ballojeh and Arman Kahzadian as participants in the HBO intrusion. Prosecutors say attackers stole unreleased episodes, scripts and other proprietary material and demanded payment in Bitcoin, with the demand starting at $5.5 million and rising to about $6 million. The indictment does not allege that HBO paid the ransom. Mesri had been charged separately over the HBO attack in 2017; the new filing incorporates that incident into the broader Mabna prosecution.

Prosecutors allege the Mabna operation targeted more than 100,000 academic accounts and successfully compromised about 8,000 professor accounts, exfiltrating at least 31.5 terabytes of academic data and intellectual property. The indictment says the activity continued until at least December 2017 and that intrusions into government and private-sector organizations generated more than $20 million in investigation and remediation costs.

The filing portrays Mabna Institute as a private firm carrying out cyber intrusions on behalf of Iran’s Islamic Revolutionary Guard Corps and other Iranian government, university and private-sector clients. Prosecutors identified additional individuals they say were involved in attacks against private companies and government entities.

The State Department’s Rewards for Justice program offered rewards of up to $10 million for information leading to the location of several people named in the indictment, including Mesri, an individual listed as Galekuhi, Kahzadian, Fayaz and Ballojeh. The superseding indictment expands legal action against a network first charged in 2018.