US Indicts 17 Mabna Operatives for IRGC Academic Espionage Targeting 322 Institutions

The indictment details how Mabna, founded in 2013 by Gholamreza Rafatnejad and Ehsan Mohammadi, used spear-phishing and stolen credentials to access engineering, medical, and technology repositories. Operatives then funneled data through Megapaper and Gigapaper resale platforms while also attempting a $6 million extortion against HBO. Five defendants—Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh—face $10 million Rewards for Justice bounties. Procurement records and prior IRGC-linked indictments show consistent patterns of academic targeting to bypass sanctions on dual-use research. The operation overlaps with earlier 2018 charges against the same cohort, indicating sustained IRGC tasking rather than ad-hoc criminal activity. Cross-referenced contract awards reveal Iranian entities funding similar open-source intelligence collection pipelines. Independent technical indicators—consistent C2 infrastructure reuse and credential stuffing tactics—align with the indictment but lack public forensic artifacts confirming direct IRGC command nodes. Official attribution rests on the superseding document; no independent third-party malware analysis has yet been released. Expect expanded sanctions lists and additional university breach notifications within 60 days as US agencies audit exposed credential caches.