The University Hack
That Never Stopped
Somewhere on a professor's desktop, an email arrived that looked exactly like the university library login page. Not at one school — across more than three hundred universities in over twenty countries, for the better part of four years. Most of the recipients never noticed a thing. Enough of them did, and the people running the operation walked away with 31.5 terabytes of research data, a working business model, and — until this week — most of their names.
On Tuesday the Justice Department unsealed a 14-count superseding indictment against 17 members of Iran's Mabna Institute, a Tehran-based hacking-for-hire outfit that spearphished its way into roughly 8,000 professor email accounts at 144 U.S. universities and 178 more overseas, plus dozens of private companies, five federal and state agencies, and international bodies including the UN. Eight of the seventeen names are new, added on top of nine defendants first charged back in 2018. Mabna didn't just steal the data and disappear — it resold it, through two Iran-based websites, Megapaper and Gigapaper, that let paying customers browse stolen research like a subscription library. The institute ran the operation on behalf of the IRGC and other Iranian government and university clients, prosecutors say — a contractor doing a state's dirty work, and turning a profit on the side.
"These defendants allegedly built and profited from a sprawling hacking-for-hire operation that targeted the intellectual property of American and allied universities, companies, and government agencies for the benefit of the Iranian government."
— Brett Leatherman, FBI Cyber Division, August 2026What strikes me isn't the scale, though 31.5 terabytes of stolen science is a lot. It's the business plan. Mabna wasn't a state cyber unit hiding behind a firewall — it was a company, with founders, a client list, contractors, and two black-market storefronts moving the product. One of the five men still at large goes by "Achilles" and "The Joker." Another is wanted separately for breaking into HBO's servers and trying to ransom Game of Thrones scripts for $6 million in Bitcoin. These aren't uniformed intelligence officers. They're hackers-for-hire who happened to land the IRGC as a client, same as they might've landed anyone else.
That's the shift worth watching. Espionage used to mean an agency running its own people. Increasingly it means a government renting capability from contractors who'll also sell to the highest bidder — and prosecutors chasing the case for eight years because the first round of charges only caught nine of the seventeen. The Rewards for Justice program is now offering $10 million for the five men still missing. The FBI's message, in Leatherman's words, was blunt: their memory is long, and time won't blunt their resolve. In this business, that's not a threat. That's the job description.
Key Takeaways
- DOJ unsealed a 14-count superseding indictment against 17 members of Iran's Mabna Institute — eight new defendants added to nine originally charged in 2018.
- From 2013 to 2017, the group compromised roughly 8,000 professor email accounts at 144 U.S. and 178 foreign universities, stealing 31.5 terabytes of academic data and intellectual property.
- Stolen research was resold to customers inside Iran through two websites, Megapaper and Gigapaper — state-sponsored espionage running as a subscription business.
- The State Department is offering $10 million for the location of five fugitive defendants, one of whom is separately wanted for hacking HBO and attempting to ransom Game of Thrones scripts.
The Blake MacKay Connection
Blake has crossed paths with plenty of state intelligence officers, but the Mabna Institute is a different animal — contractors who'll spy for whoever's paying, then resell what they steal on the side. That blurred line between state espionage and organized crime for profit is exactly the kind of gray zone Blake has to operate in when the enemy isn't a uniform, it's a business plan. Start the series free with Intercept and see how that world actually works.
Read the Full Article at U.S. Department of Justice → ← Back to Intel Briefing