Threat Intelligence & APT SecurityWeek 1 month ago

US Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of Them

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"The US this week announced charges against 17 members of the Iran-based company Mabna Institute for hacking into hundreds of organizations in the US and abroad. According to a 14-count superseding indictment, Mabna Institute was founded in 2013 to help universities and research organizations in the country steal non-Iranian scientific resources. It has targeted universities in the US (144) and..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Iranian APTs

The US this week announced charges against 17 members of the Iran-based company Mabna Institute for hacking into hundreds of organizations in the US and abroad.

According to a 14-count superseding indictment, Mabna Institute was founded in 2013 to help universities and research organizations in the country steal non-Iranian scientific resources.

It has targeted universities in the US (144) and abroad (178), private companies in the US (42) and abroad (11), five government agencies in the US, and at least two NGOs, stealing over 31 terabytes of academic data and intellectual property, as well as employee email accounts.

The 17 defendants charged over these intrusions acted on behalf of the Islamic Republic of Iran’s Islamic Revolutionary Guard Corps (IRGC), the Justice Department says.

According to the indictment, the Mabna Institute was founded by Gholamreza Rafatnejad and Ehsan Mohammadi, and employed, contracted, and affiliated with Abdollah Karima (aka Vahid Karima), Mostafa Sadeghi, Seyed Ali Mirkarmi, Mohammed Reza Sabahi, Roozbeh Sabahi, Abuzar Gohari Moqadam, Sajjad Tahmasebi, Saeid Houshyar, Behzad Mesri (aka Skote Vahshat), Manouchehr Hashemloo, Keyvan Fayaz (aka Achilles, The Joker, and bc.monster), Amir Barati, Saber Shahbazi Ballojeh, Arman Kahzadian, and Mojtaba Galekuhi (aka Mojtaba Ghaleh Koui).

The Mabna Institute allegedly conducted cyber intrusions on behalf of both the Iranian government and private organizations.

Advertisement. Scroll to continue reading.

Through the Rewards for Justice program (RFJ), the US government is offering rewards of up to $10 million for information leading to the arrest of Mesri, Galekuhi, Kahzadian, Fayaz, and Ballojeh.

Written By Ionut Arghire

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →