{"investigation":{"slug":"mabna-institute-irgc-cyber-contractor-doj-indictment-august-2026","entity_name":"Mabna Institute (IRGC Cyber Contractor — DOJ Indictment August 2026)","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.85,"status":"draft","content_type":"investigation","summary":"The Mabna Institute is a Tehran-based company that U.S. prosecutors allege has operated since approximately 2013 as a hacking-for-hire contractor for Iran's Islamic Revolutionary Guard Corps (IRGC) and other Iranian government and university clients. On August 18, 2026, the Department of Justice unsealed a 14-count superseding indictment charging 17 alleged members — expanding on nine defendants originally charged in 2018 — with a years-long campaign that allegedly compromised 144 U.S. and 178 foreign universities, dozens of private companies, and several government agencies, stealing over 31 terabytes of data. Days later, the U.S. Treasury sanctioned five Mabna-linked individuals and 30 associated cryptocurrency addresses (Bitcoin, Ethereum, TRON) that blockchain analytics firm TRM Labs traced to roughly $16.8 million in inflows since 2018.","sections":[{"content":"On August 18, 2026, the U.S. Department of Justice unsealed a 14-count superseding indictment charging 17 alleged members of the Mabna Institute, an Iran-based company prosecutors say conducted a coordinated campaign of computer intrusions since at least 2013 on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC) and other Iranian government and university clients. Nine of the 17 defendants were originally charged in a March 2018 indictment; the 2026 filing adds eight more individuals and broadens the alleged victim set. The indictment alleges the group targeted more than 100,000 professor email accounts worldwide and compromised approximately 8,000 of them, ultimately stealing more than 31.5 terabytes of academic data and intellectual property from 144 U.S. universities, 178 foreign universities, at least 42 U.S. private-sector companies, at least 11 foreign companies, at least five U.S. federal and state government agencies, and at least two nongovernmental organizations. Founders Gholamreza Rafatnejad and Ehsan Mohammadi are alleged to have established the institute around 2013. FBI Assistant Director Brett Leatherman was quoted stating the defendants 'allegedly built and profited from a sprawling hacking-for-hire operation that targeted intellectual property.' These are allegations contained in an indictment; the defendants, who are believed to be outside U.S. jurisdiction, have not been convicted and the charges are not proof of guilt.","heading":"DOJ Indictment — Cyber Espionage and Hacking-for-Hire","sources":[{"url":"https://www.justice.gov/opa/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary","name":"17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities — DOJ Office of Public Affairs","type":"regulatory","credibility":1},{"url":"https://www.washingtontimes.com/news/2026/aug/19/doj-charges-17-iran-linked-mabna-institute-university-hacking-case/","name":"DOJ charges 17 in Iran-linked Mabna Institute university hacking case — Washington Times","type":"news_article","credibility":1},{"url":"https://www.cybersecuritydive.com/news/doj-charges-17-iran-hacking-campaign-us-university/828212/","name":"DOJ charges 17 people in Iran-backed hacking campaign against US — Cybersecurity Dive","type":"news_article","credibility":2},{"url":"https://thehill.com/regulation/court-battles/6036708-doj-indicts-iranian-cyber-hackers/","name":"Justice Department secures indictment of 17 Iranians accused of 'massive' cyber theft campaign — The Hill","type":"news_article","credibility":1}],"severity":"critical"},{"content":"One defendant, Behzad Mesri, was separately charged in United States v. Behzad Mesri (17 Cr. 689, S.D.N.Y.) with hacking into HBO's computer systems, stealing proprietary data — including unreleased scripts — and then allegedly attempting to extort HBO for approximately $6 million worth of Bitcoin. This is the clearest documented link between the Mabna-associated network and cryptocurrency prior to the 2026 sanctions action, and it predates the superseding indictment by nearly a decade.","heading":"Alleged HBO Extortion and Attempted Bitcoin Ransom","sources":[{"url":"https://www.justice.gov/opa/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary","name":"17 Iranians Charged with Conducting Massive Cyber Theft Campaign — DOJ Office of Public Affairs","type":"regulatory","credibility":1}],"severity":"high"},{"content":"On August 24, 2026, the U.S. Department of the Treasury launched 'Operation Economic Outcast,' described as a whole-of-government economic campaign against Iran, designating nearly 60 Iran-linked entities, individuals, and vessels and issuing sectoral sanctions determinations under Executive Order 13902 — including, for the first time, a determination naming digital assets a sanctionable sector of the Iranian economy. As part of this action, Treasury's Office of Foreign Assets Control (OFAC) designated five individuals linked to the Mabna Institute — the same five for whom the State Department's Rewards for Justice program had offered bounties — and listed 30 associated cryptocurrency addresses spanning Bitcoin, Ethereum, and TRON. Blockchain analytics firm TRM Labs analyzed the 30 addresses and found approximately $16.8 million in cumulative inflows between January 2018 and August 20, 2026, with roughly $202,662 (about 1% of total volume) remaining in the addresses at the time of analysis. TRM Labs found the funds were highly concentrated: defendant Keyvan Fayaz allegedly controlled ten of the addresses accounting for approximately $15.5 million, or 92% of all inflows, suggesting he functioned as a financial hub for the network. A second defendant, Behzad Mesri, was found to have conducted layered transactions routing to centralized exchange deposits. TRM Labs noted that addresses which have touched the flagged wallets carry elevated risk in transaction-monitoring systems, and flagged TRON-based stablecoins as a preferred value-transfer mechanism observed in the network's activity across restricted jurisdictions.","heading":"Treasury Sanctions and Cryptocurrency Address Designations","sources":[{"url":"https://www.trmlabs.com/resources/blog/operation-economic-outcast-treasury-sanctions-nearly-60-iran-linked-targets-and-names-digital-assets-a-sanctionable-sector","name":"Operation Economic Outcast: Treasury Sanctions Nearly 60 Iran-linked Targets and Names Digital Assets a Sanctionable Sector — TRM Labs","type":"research","credibility":2},{"url":"https://cryptobriefing.com/mabna-institute-crypto-addresses-trm-labs/","name":"Mabna Institute moved $16.8M through crypto addresses since 2018, TRM Labs finds — Crypto Briefing","type":"news_article","credibility":2},{"url":"https://www.infosecurity-magazine.com/news/us-sanctions-mabna-institute/","name":"US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks — Infosecurity Magazine","type":"news_article","credibility":2},{"url":"https://www.sullcrom.com/insights/memo/2026/August/Treasury-Department-Launches-Operation-Economic-Outcast","name":"Treasury Department Launches Operation Economic Outcast — Sullivan & Cromwell LLP","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/08/us-sanctions-iran-linked-hackers-behind.html","name":"US Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches — The Hacker News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"In connection with the August 2026 charges, the U.S. State Department's Rewards for Justice program announced rewards of up to $10 million for information leading to the location or arrest of five defendants: Behzad Mesri, Mojtaba Galekuhi, Arman Kahzadian, Keyvan Fayaz, and Saber Shahbazi Ballojeh. These same five individuals were also named in Treasury's August 24, 2026 sanctions designations. The defendants are believed to reside in Iran, outside the reach of routine U.S. extradition.","heading":"Rewards for Justice Bounties","sources":[{"url":"https://www.justice.gov/opa/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary","name":"17 Iranians Charged with Conducting Massive Cyber Theft Campaign — DOJ Office of Public Affairs","type":"regulatory","credibility":1},{"url":"https://databreaches.net/2026/08/19/doj-secures-indictment-of-17-iranians-accused-of-massive-cyber-theft-campaign/","name":"DOJ secures indictment of 17 Iranians accused of 'massive' cyber theft campaign — DataBreaches.Net","type":"news_article","credibility":2}],"severity":"high"},{"content":"Because OFAC has designated the 30 identified addresses as Specially Designated Nationals (SDN) property, U.S. persons and regulated exchanges are generally prohibited from transacting with them, and any addresses found to have received funds from them may be treated as elevated-risk in sanctions-screening and transaction-monitoring systems, per TRM Labs' compliance guidance. Given the concentration of funds in a small number of addresses (92% controlled by one defendant) and the use of TRON-based stablecoins flagged as a preferred value-transfer mechanism in the network's alleged activity, platforms operating in or near jurisdictions with weaker sanctions enforcement should treat any counterparty exposure to this address cluster as a compliance red flag. This guidance reflects sanctions-compliance commentary from TRM Labs and law-firm client alerts rather than a specific enforcement action against any third-party exchange.","heading":"Risk Guidance for Crypto Platforms and Users","sources":[{"url":"https://www.trmlabs.com/resources/blog/operation-economic-outcast-treasury-sanctions-nearly-60-iran-linked-targets-and-names-digital-assets-a-sanctionable-sector","name":"Operation Economic Outcast: Treasury Sanctions Nearly 60 Iran-linked Targets and Names Digital Assets a Sanctionable Sector — TRM Labs","type":"research","credibility":2},{"url":"https://www.paulhastings.com/insights/client-alerts/treasury-issues-additional-iran-related-sanctions-suspends-general-licenses-and-pledges-additional-action-under-operation-economic-outcast","name":"Treasury Issues Additional Iran-Related Sanctions, Suspends General Licenses, and Pledges Additional Action Under Operation Economic Outcast — Paul Hastings LLP","type":"research","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2013","event":"Mabna Institute is alleged to have been founded in Tehran by Gholamreza Rafatnejad and Ehsan Mohammadi, and its cyber-intrusion campaign is alleged to have begun around this time.","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary"},{"date":"2017","event":"Behzad Mesri is alleged to have hacked HBO's systems and attempted to extort the company for approximately $6 million worth of Bitcoin; the original campaign described in the indictment is alleged to have continued through at least December 2017.","source":"DOJ Office of Public Affairs / CyberMaxx","source_url":"https://www.justice.gov/opa/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary"},{"date":"2018-03","event":"DOJ files the original indictment charging nine alleged Mabna Institute members.","source":"DOJ Office of Public Affairs / Crypto Briefing","source_url":"https://cryptobriefing.com/mabna-institute-crypto-addresses-trm-labs/"},{"date":"2026-08","event":"DOJ unseals a 14-count superseding indictment charging 17 alleged Mabna Institute members, adding eight new defendants to the original nine.","source":"DOJ Office of Public Affairs","source_url":"https://www.justice.gov/opa/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary","date_evidence":"A 14-count superseding (S2) indictment was unsealed today charging 17 members of the Mabna Institute","date_original":"2026-08-18"},{"date":"2026-08","event":"U.S. Treasury launches 'Operation Economic Outcast,' sanctioning five Mabna-linked individuals and 30 associated cryptocurrency addresses across Bitcoin, Ethereum, and TRON, and issuing a sectoral determination naming digital assets a sanctionable sector of Iran's economy.","source":"TRM Labs / Sullivan & Cromwell","source_url":"https://www.trmlabs.com/resources/blog/operation-economic-outcast-treasury-sanctions-nearly-60-iran-linked-targets-and-names-digital-assets-a-sanctionable-sector","date_original":"2026-08-24"},{"date":"2026-08","event":"TRM Labs' analysis window for the 30 sanctioned addresses closes, with cumulative inflows since January 2018 totaling approximately $16.8 million and a residual balance of roughly $202,662 (about 1% of total volume) as of this date.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/operation-economic-outcast-treasury-sanctions-nearly-60-iran-linked-targets-and-names-digital-assets-a-sanctionable-sector","date_original":"2026-08-20"}],"sources_used":[{"url":"https://www.justice.gov/opa/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary","name":"17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities — DOJ Office of Public Affairs","type":"regulatory","archive_url":"http://web.archive.org/web/20260920193149/https://www.justice.gov/opa/pr/17-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary","credibility":1,"archive_timestamp":"2026-09-20T19:31:49+00:00"},{"url":"https://www.washingtontimes.com/news/2026/aug/19/doj-charges-17-iran-linked-mabna-institute-university-hacking-case/","name":"DOJ charges 17 in Iran-linked Mabna Institute university hacking case — Washington Times","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.cybersecuritydive.com/news/doj-charges-17-iran-hacking-campaign-us-university/828212/","name":"DOJ charges 17 people in Iran-backed hacking campaign against US — Cybersecurity Dive","type":"news_article","archive_url":"http://web.archive.org/web/20260911200532/https://www.cybersecuritydive.com/news/doj-charges-17-iran-hacking-campaign-us-university/828212/","credibility":2,"archive_timestamp":"2026-09-11T20:05:32+00:00"},{"url":"https://thehill.com/regulation/court-battles/6036708-doj-indicts-iranian-cyber-hackers/","name":"Justice Department secures indictment of 17 Iranians accused of 'massive' cyber theft campaign — The Hill","type":"news_article","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://databreaches.net/2026/08/19/doj-secures-indictment-of-17-iranians-accused-of-massive-cyber-theft-campaign/","name":"DOJ secures indictment of 17 Iranians accused of 'massive' cyber theft campaign — DataBreaches.Net","type":"news_article","archive_url":"http://web.archive.org/web/20260831143043/https://databreaches.net/2026/08/19/doj-secures-indictment-of-17-iranians-accused-of-massive-cyber-theft-campaign/","credibility":2,"archive_timestamp":"2026-08-31T14:30:43+00:00"},{"url":"https://www.cybermaxx.com/resources/mabna-institute-indictment-expands-the-record-of-iranian-cyber-espionage/","name":"Mabna Institute Indictment Expands the Record of Iranian Cyber Espionage — CyberMaxx","type":"research","archive_url":"https://web.archive.org/web/20260924005810/https://www.cybermaxx.com/resources/mabna-institute-indictment-expands-the-record-of-iranian-cyber-espionage/","credibility":2,"archive_timestamp":"2026-09-24T00:58:10+00:00"},{"url":"https://cryptobriefing.com/mabna-institute-crypto-addresses-trm-labs/","name":"Mabna Institute moved $16.8M through crypto addresses since 2018, TRM Labs finds — Crypto Briefing","type":"news_article","archive_url":"http://web.archive.org/web/20260826131704/https://cryptobriefing.com/mabna-institute-crypto-addresses-trm-labs/","credibility":2,"archive_timestamp":"2026-08-26T13:17:04+00:00"},{"url":"https://www.trmlabs.com/resources/blog/operation-economic-outcast-treasury-sanctions-nearly-60-iran-linked-targets-and-names-digital-assets-a-sanctionable-sector","name":"Operation Economic Outcast: Treasury Sanctions Nearly 60 Iran-linked Targets and Names Digital Assets a Sanctionable Sector — TRM Labs","type":"research","archive_url":"http://web.archive.org/web/20260921122224/https://www.trmlabs.com/resources/blog/operation-economic-outcast-treasury-sanctions-nearly-60-iran-linked-targets-and-names-digital-assets-a-sanctionable-sector","credibility":2,"archive_timestamp":"2026-09-21T12:22:24+00:00"},{"url":"https://finance.biggo.com/news/24e4dffd-59cb-45c2-8fd1-0bfe6ead746c","name":"US Sanctions 30 Crypto Wallets Tied to Iran's Mabna Institute, Tracing $16.8 Million — BigGo Finance","type":"news_article","archive_url":"http://web.archive.org/web/20260826132232/https://finance.biggo.com/news/24e4dffd-59cb-45c2-8fd1-0bfe6ead746c","credibility":2,"archive_timestamp":"2026-08-26T13:22:32+00:00"},{"url":"https://coinpaper.com/34737/iran-sanctions-trm-labs-tracks-168m-across-30-mabna-institute-crypto-wallets","name":"Iran Sanctions: TRM Labs Tracks $16.8M Across 30 Mabna Institute Crypto Wallets — Coinpaper","type":"news_article","archive_url":"https://web.archive.org/web/20260924004927/https://coinpaper.com/34737/iran-sanctions-trm-labs-tracks-168m-across-30-mabna-institute-crypto-wallets","credibility":2,"archive_timestamp":"2026-09-24T00:49:27+00:00"},{"url":"https://www.infosecurity-magazine.com/news/us-sanctions-mabna-institute/","name":"US Sanctions Mabna Institute Hackers for Iranian Cyber-Attacks — Infosecurity Magazine","type":"news_article","archive_url":"http://web.archive.org/web/20260906210238/https://www.infosecurity-magazine.com/news/us-sanctions-mabna-institute/","credibility":2,"archive_timestamp":"2026-09-06T21:02:38+00:00"},{"url":"https://thehackernews.com/2026/08/us-sanctions-iran-linked-hackers-behind.html","name":"US Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches — The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260918083038/https://thehackernews.com/2026/08/us-sanctions-iran-linked-hackers-behind.html","credibility":2,"archive_timestamp":"2026-09-18T08:30:38+00:00"},{"url":"https://www.sullcrom.com/insights/memo/2026/August/Treasury-Department-Launches-Operation-Economic-Outcast","name":"Treasury Department Launches Operation Economic Outcast — Sullivan & Cromwell LLP","type":"research","archive_url":"http://web.archive.org/web/20260919005921/https://www.sullcrom.com/insights/memo/2026/August/Treasury-Department-Launches-Operation-Economic-Outcast","credibility":2,"archive_timestamp":"2026-09-19T00:59:21+00:00"},{"url":"https://www.paulhastings.com/insights/client-alerts/treasury-issues-additional-iran-related-sanctions-suspends-general-licenses-and-pledges-additional-action-under-operation-economic-outcast","name":"Treasury Issues Additional Iran-Related Sanctions, Suspends General Licenses, and Pledges Additional Action Under Operation Economic Outcast — Paul Hastings LLP","type":"research","archive_url":"http://web.archive.org/web/20260901153429/https://www.paulhastings.com/insights/client-alerts/treasury-issues-additional-iran-related-sanctions-suspends-general-licenses-and-pledges-additional-action-under-operation-economic-outcast","credibility":2,"archive_timestamp":"2026-09-01T15:34:29+00:00"},{"url":"https://www.bitget.com/news/detail/12560605724217","name":"TRM Labs Traces $16.8 Million Across 30 Sanctioned Iran-Linked Crypto Wallets — Bitget News","type":"news_article","archive_url":"https://web.archive.org/web/20260924052911/https://www.bitget.com/news/detail/12560605724217","credibility":2,"archive_timestamp":"2026-09-24T05:29:11+00:00"},{"url":"https://www.steptoe.com/en/news-publications/international-compliance-blog/weekly-sanctions-update-august-31-2026.html","name":"Weekly Sanctions Update: August 31, 2026 — Steptoe","type":"research","archive_url":"http://web.archive.org/web/20260915114026/https://www.steptoe.com/en/news-publications/international-compliance-blog/weekly-sanctions-update-august-31-2026.html","credibility":2,"archive_timestamp":"2026-09-15T11:40:26+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-23T23:20:08.680159+00:00","updated_at":"2026-09-24T08:48:32.988997+00:00"}}