US DOJ Indictment of Mabna Institute and IRGC for Cyber Espionage

The U.S. Department of Justice has indicted 17 members of the Iran-based Mabna Institute, operating on behalf of the Islamic Revolutionary Guard Corps (IRGC), for a systemic cyber theft campaign. The actors targeted U.S. government agencies and academic institutions via the unauthorized compromise of high-level email accounts and university research databases. The campaign utilized dedicated Command and Control (C2) infrastructure to maintain long-term persistence and exfiltrate sensitive intellectual property (IP) and proprietary research data. The primary objective was the acquisition of strategic data to advance Iranian national interests through targeted espionage.

• Incident Overview: State-Sponsored Espionage

  • Indictment of 17 Iranian nationals linked to the Mabna Institute.
  • Operations conducted as a proxy for the Islamic Revolutionary Guard Corps (IRGC) to maintain plausible deniability.
  • Long-term strategic campaign focused on the theft of intellectual property from the U.S. and foreign institutions.

• Attack Vector: Account Compromise & Exfiltration

  • Primary intrusion vector centered on the unauthorized access of high-level government and academic email accounts.
  • Targeted harvesting of data from university research databases to identify and steal proprietary information.
  • Utilization of specific IP exfiltration techniques to move sensitive data from secure environments to IRGC-controlled servers.

• Threat Actor Profile: Mabna Institute & IRGC

  • Mabna Institute functions as a front company providing technical capabilities for IRGC-directed cyber operations.
  • Demonstrated capacity for broad-spectrum targeting across the public sector, private industry, and academia.
  • Focuses on high-value research data to support Iranian national interests and technological advancement.

• Infrastructure & Persistence

  • Deployment of specialized Command and Control (C2) infrastructure to facilitate long-term residence within compromised networks.
  • Focus on stealthy persistence to avoid detection while monitoring communications and exfiltrating data over extended periods.
  • Strategic selection of target accounts to gain maximum lateral movement capabilities within academic and government networks.

• Impact & Law Enforcement Action

  • Compromise of dozens of U.S. universities and multiple government agency email systems.
  • Significant loss of intellectual property and sensitive research across various scientific and technical disciplines.
  • Superseding indictment by the DOJ aimed at exposing the operational structure of the IRGC's cyber capabilities.