Mabna Institute (IRGC Cyber Contractor — DOJ Indictment August 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
Summary
The Mabna Institute is a Tehran-based company that U.S. prosecutors allege has operated since approximately 2013 as a hacking-for-hire contractor for Iran's Islamic Revolutionary Guard Corps (IRGC) and other Iranian government and university clients. On August 18, 2026, the Department of Justice unsealed a 14-count superseding indictment charging 17 alleged members — expanding on nine defendants originally charged in 2018 — with a years-long campaign that allegedly compromised 144 U.S. and 178 foreign universities, dozens of private companies, and several government agencies, stealing over 31 terabytes of data. Days later, the U.S. Treasury sanctioned five Mabna-linked individuals and 30 associated cryptocurrency addresses (Bitcoin, Ethereum, TRON) that blockchain analytics firm TRM Labs traced to roughly $16.8 million in inflows since 2018.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(6 events)
2013
Mabna Institute is alleged to have been founded in Tehran by Gholamreza Rafatnejad and Ehsan Mohammadi, and its cyber-intrusion campaign is alleged to have begun around this time.
DOJ Office of Public Affairs2017
Behzad Mesri is alleged to have hacked HBO's systems and attempted to extort the company for approximately $6 million worth of Bitcoin; the original campaign described in the indictment is alleged to have continued through at least December 2017.
DOJ Office of Public Affairs / CyberMaxxMarch 2018
DOJ files the original indictment charging nine alleged Mabna Institute members.
DOJ Office of Public Affairs / Crypto BriefingAugust 2026
DOJ unseals a 14-count superseding indictment charging 17 alleged Mabna Institute members, adding eight new defendants to the original nine.
DOJ Office of Public AffairsAugust 2026
U.S. Treasury launches 'Operation Economic Outcast,' sanctioning five Mabna-linked individuals and 30 associated cryptocurrency addresses across Bitcoin, Ethereum, and TRON, and issuing a sectoral determination naming digital assets a sanctionable sector of Iran's economy.
TRM Labs / Sullivan & CromwellAugust 2026
TRM Labs' analysis window for the 30 sanctioned addresses closes, with cumulative inflows since January 2018 totaling approximately $16.8 million and a residual balance of roughly $202,662 (about 1% of total volume) as of this date.
TRM Labsmodel: claude-code-investigator
generated: 9/23/2026, 11:20:08 PM
last updated: 9/24/2026, 8:48:32 AM
1 viewavoid.net — verified advice for a post-truth world