Aug 19, 2026 · 6 min read

US Charges 17 Iranians Over $3.4B Mailbox Theft

The Justice Department added eight defendants to the Mabna Institute case, a hacking for hire operation that phished more than 100,000 academics and used the mailboxes it opened to drain 31.5 terabytes of research. The entire chain started with an email.

No zero day. No malware family with a clever name. The Mabna Institute built a multibillion dollar theft business on emails that looked like they came from a colleague, and on passwords that people reused. Prosecutors now say the operation ran on behalf of the Islamic Revolutionary Guard Corps from roughly 2013 onward, selling stolen journal access and corporate documents to paying Iranian customers.

Key Takeaways

The Justice Department charged eight additional Iranian nationals on 17 August 2026, bringing the Mabna Institute case to 17 defendants, nine of whom were first indicted in March 2018.
The defendants targeted the email accounts of more than 100,000 professors worldwide and successfully compromised roughly 8,000 of them.
Victims include 178 universities, 144 of them in the United States, plus more than 53 private firms, two NGOs and at least ten US federal and state agencies.
The stolen material came to 31.5 terabytes of academic data and intellectual property, valued by prosecutors at about $3.4 billion.
The State Department is offering rewards of up to $10 million for information locating five of the defendants.

What Did the DOJ Actually Charge?

The superseding indictment adds Saeid Houshyar, Behzad Mesri, Manouchehr Hashemloo, Keyvan Fayaz, Amir Barati, Saber Shahbazi Ballojeh, Arman Kahzadian and Mojtaba Galekuhi to a case first unsealed in 2018. The counts include conspiracy to commit computer intrusion, wire fraud and aggravated identity theft, with maximum terms of 20 years. Mesri is the same defendant tied to the 2017 extortion of HBO for $6 million in Bitcoin.

The original 2018 charging documents remain the best primary source on the mechanics of the campaign, and the Department of Justice announcement lays out the customer facing side: websites where Iranian buyers could search stolen credentials and log into foreign university library systems using a real professor's account.

How Did the Spearphishing Actually Work?

The operators read their targets before writing to them. Prosecutors describe a research phase in which defendants scraped faculty pages, published papers and conference listings to learn what a given academic worked on, then wrote an email that a specialist would find plausible.

Pretext: a message appearing to come from a professor at another institution, referencing a genuine paper and asking the target to review or download it.
Delivery: a link, not an attachment, which sidesteps most attachment scanning entirely.
Harvest: a login page cloned from the victim's own university single sign on portal, capturing username and password verbatim.
Access: direct sign in to the mailbox, followed by exfiltration of correspondence, unpublished manuscripts, grant material and library entitlements.

A roughly 8% success rate against 100,000 highly educated targets is the number worth sitting with. Convincing context beats technical sophistication, which is the same conclusion drawn about Iranian operators posing as cybersecurity experts to phish journalists' Gmail accounts.

A university researcher working at a laptop late at night in a quiet library reading room

Where Did Password Spraying Come In?

Password spraying was the tool used against companies and government agencies, where personalised academic lures would have made no sense. Instead of guessing many passwords against one account, the operators tried a small set of common passwords against thousands of accounts, staying under lockout thresholds that only count failures per user.

That technique has not aged out. Identity telemetry through 2026 shows spraying volume climbing sharply as attackers move to legacy authentication paths that never present a second factor, which we covered in the 155x surge in password spraying against Entra ID. The CISA advisory catalogue has documented Iranian state aligned use of the same pattern repeatedly since.

Why the Mailbox Was the Prize

The indictment is framed around intellectual property, but every stage of the theft ran through an inbox. A compromised academic mailbox is not one document. It is a decade of drafts, peer review correspondence, grant applications, coauthor addresses, publisher entitlements and password reset authority over every other service the person uses.

It is also a launchpad. Once operators hold a real professor's account, the next spearphish is not a lookalike domain. It is genuine mail from a genuine colleague, with real thread history, which is why 8,000 compromises could plausibly generate 100,000 attempts. The victim list reaching two NGOs and ten government agencies suggests the campaign kept pivoting outward from each foothold.

If your threat model includes a state aligned buyer paying for research access, treat your mailbox as the crown jewel rather than the notification channel. Reporters and NGO staff face the same calculus: the archive is worth more than any single message in it.

How Do You Harden a Mailbox Against This?

Phishing resistant authentication is the single control that breaks this attack chain, because a cloned login page cannot replay a hardware bound credential. The rest closes the gaps attackers use once a password does leak.

Move to passkeys or security keys. WebAuthn credentials are bound to the real origin, so a fake university portal receives nothing usable. The W3C WebAuthn specification describes the origin binding that makes this work. SMS codes and one time passwords can still be relayed in real time.
Kill app passwords. They bypass your second factor by design. Google's app password documentation makes the tradeoff explicit, and attackers have exploited it, as in the Russian campaign that talked targets into issuing app passwords.
Audit forwarding rules monthly. Silent auto forwarding to an external address is the most common persistence trick after mailbox compromise. Check Gmail settings under Forwarding and POP/IMAP, plus every filter with a forward or delete action.
Review third party OAuth grants. A revoked password does nothing to an app that already holds a mail scope token.
Check active sessions and connected devices after any suspected phish, and sign out everything rather than trusting a password change alone.

Institutions should add tenant wide alerting on new forwarding rules and on successful sign ins from unusual autonomous systems. The NIST SP 800-63B guidance on authenticator assurance is the reference worth citing internally when arguing for hardware keys over codes.

What to Watch Next

All 17 defendants are believed to be in Iran, so the practical value of these charges is attribution and deterrence rather than arrest, and the $10 million rewards signal that the government expects the operation to still be running. Note the shape of it: a private contractor selling to a state sponsor and to commercial buyers at the same time. That hybrid model, tracked in the Council on Foreign Relations cyber operations tracker, is now the norm rather than the exception, and it means the defender across from you may be motivated by an invoice rather than an intelligence requirement.