WASHINGTON (Reuters) - The United States on Friday charged and sanctioned nine Iranians and an Iranian company for attempting to hack into hundreds of universities worldwide, dozens of firms and parts of the U.S. government, including its main energy regulator, on behalf of Tehran’s government.

The cyber attacks, beginning in at least 2013, pilfered more than 31 terabytes of academic data and intellectual property from 144 U.S. universities and 176 universities in 21 other countries, the U.S. Department of Justice said, describing the campaign as one of the largest state-sponsored hacks ever prosecuted.

The U.S. Treasury Department said it was placing sanctions on the nine people and the Mabna Institute, a company U.S. prosecutors characterized as designed to help Iranian research organizations steal information.

U.S. Deputy Attorney General Rod Rosenstein said the nine Iranians were considered fugitives who may face extradition in more than 100 countries if they travel outside Iran.

Authorities “will aggressively investigate and prosecute hostile actors who attempt to profit from America’s ideas by infiltrating our computer systems and stealing intellectual property,” Rosenstein told a news conference.

The case “will disrupt the defendants’ hacking operations and deter similar crimes,” he added.

The hackers were not accused of being directly employed by Iran’s government. They were instead charged with criminal conduct waged primarily through the Mabna Institute on behalf of the Islamic Revolutionary Guard Corps, the elite military force assigned to defend Iran’s Shi’ite theocracy from internal and external threats.

In Tehran, Iran’s foreign ministry spokesman Bahram Qasemi denounced the move as “provocative, illegitimate, and without any justifiable reason and another sign of the hostility of the (U.S.) ruling circles toward the Iranian nation”, state news agency IRNA said.

The targeting of the Federal Energy Regulatory Commission, or FERC, was a matter of special concern, U.S. Attorney Geoffrey Berman said, because it oversees the interstate regulation of energy and holds details of some of the country’s “most sensitive infrastructure.”

Hackers targeted email accounts of more than 100,000 professors worldwide, half in the United States, and compromised about 8,000, prosecutors said. Hackers also targeted the U.S. Labor Department, the United Nations and the computer systems of the U.S. states Hawaii and Indiana, prosecutors said.

Friday’s actions are part of an effort by senior cyber security officials at the White House and across the U.S. government to blame foreign countries for malicious hacks.

They were announced a day after U.S. President Donald Trump named John Bolton, a former U.S. ambassador to the United Nations who is deeply skeptical of the 2015 international nuclear accord with Iran, as his new national security adviser.

Trump himself has repeatedly cast doubt on the nuclear deal, in which the U.S. and other world powers eased sanctions in exchange for Tehran putting limits on its nuclear program.

INTERNET FIRMS ALERTED

The Department of Justice on Friday privately warned major internet infrastructure companies to expect attacks from Iran, an executive at one company who received the alert said.

The officials said the most likely retaliation would be denial of service attacks on websites, which are not destructive but disrupt commerce and communication.

U.S. Deputy Attorney General Rod Rosenstein speaks at a news conference with other law enforcement officials at the Justice Department to announce nine Iranians charged with conducting massive cyber theft campaign, in Washington, U.S., March 23, 2018. REUTERS/Yuri Gripas

Britain’s National Cyber Security Centre said on Twitter the Mabna Institute was “almost certainly responsible for cyber attacks targeting universities around the world.”

The sanctions and charges were the fourth time in the past few months the Trump administration has blamed a foreign government for major cyber attacks, a practice that was rare under the Obama administration.

Last week, the administration accused the Russian government of cyber attacks stretching back at least two years that targeted the U.S. power grid.

Washington imposed new sanctions on 19 Russians and five groups, including Moscow’s intelligence services, for meddling in the 2016 U.S. election and other cyber attacks.

Friday’s indictment in U.S. District Court in New York said the Iranian hackers did extensive background research of university professors before sending them “spearphishing” emails tailored to academic interests and scholarly publications.

The emails purported to be from professors at another university and indicated the sender had read an article written by them, prosecutors said.

The emails would then direct recipients to click on links to related articles directing them to a malicious internet domain that appeared similar to the victims’ actual university portal, where they would be prompted to enter their login credentials.

Once accounts were compromised, the hackers would steal reams of academic data and intellectual property related to science and technology, engineering, social sciences and medicine, the indictment said.

Stolen data was obtained to benefit Iran’s Revolutionary Guard and sold in Iran through the websites Megapaper and Gigapaper to universities there, prosecutors said.

‘PASSWORD SPRAYING’

Hackers targeted and compromised employee email accounts at 36 U.S.-based companies and 11 companies in countries including Britain, Germany and Italy, prosecutors said.

Victim companies in the United states included two media and entertainment companies, one law firm, 11 technology firms, and two bank and investment firms, among others.

Unlike the precise targeting of academics, companies were subjected to a broad technique known as “password spraying” that uncovers lists of company email accounts online and then tries to hack into them with common default passwords.

Once inside, the hackers would steal entire email mailboxes.

The Treasury Department also put sanctions on another Iranian, Behzad Mesri. Sometimes known as “Skote Vahshat,” Mesri was charged in 2017 with hacking cable TV network HBO to leak unaired episodes of the fantasy drama Game of Thrones.

Mesri is still at large, officials said.

Slideshow (6 Images)

The Obama administration in 2016 indicted seven Iranians for distributed-denial-of-service attacks on dozens of U.S. banks and for trying to shut down a New York dam. Those hackers were also accused of working on behalf of Iran’s government.

None of the Iranians indicted in 2016 have been arrested or extradited, a Justice Department spokesman said.</s>WASHINGTON: The United States unveiled charges on Friday against nine Iranians for their alleged involvement in a massive state-sponsored hacking scheme which targeted hundreds of universities in the US and abroad and stole “valuable intellectual property and data.”

Ten Iranians were also hit with sanctions along with an Iranian company, the Mabna Institute, which engaged in computer hacking on behalf of Iran‘s Revolutionary Guards, the US Treasury Department said. The two founders of the Mabna Institute, Gholamreza Rafatnejad, 38, and Ehsan Mohammadi, 37, were among the nine Iranians indicted in New York and whose assets are subject to US seizure.

Since 2013, the Mabna Institute carried out cyber intrusions into the computer systems of 144 US universities, the Treasury Department said, and 176 universities in 21 foreign countries. Mabna Institute employees and contractors “engaged in the theft of valuable intellectual property and data from hundreds of US and third-country universities... for private financial gain,” it said.

“For many of these intrusions, the defendants acted at the behest of the Iranian government and, specifically, the Iranian Revolutionary Guard Corps,” Deputy Attorney General Rod Rosenstein said. The US Department of Labor, the US Federal Energy Regulatory Commission, dozens of private firms and non-governmental organizations such as the UN Children’s Fund were also allegedly targeted.</s>The US on Friday announced sanctions against nine Iranians and an Iranian company for attempting to hack into hundreds of universities worldwide, including in Ireland, on behalf of Tehran’s government.

The cyberattacks, beginning in at least 2013, pilfered more than 31 terabytes of academic data and intellectual property from 144 US universities and 176 universities in 21 other countries, the US Department of Justice said.

It described the conspiracy as one of the largest state-sponsored hacking sprees prosecuted.

The US Treasury Department said that it was placing sanctions on the nine accused individuals and the Mabna Institute, a company described by US prosecutors as designed to help Iranian research organisations steal information.

“These defendants are now fugitives of justice,” US deputy attorney general Rod Rosenstein said at a press conference. Mr Rosenstein said they may face extradition in more than 100 countries if they travel outside of Iran.

Hackers targeted email accounts of more than 100,000 professors worldwide and compromised about 8,000 of them, prosecutors said. Hackers also targeted the US Labor Department, the US Federal Energy Regulatory Commission, the United Nations and the computer systems of the US states Hawaii and Indiana, prosecutors said.

The UK government backed the action taken by Washington and revealed that British universities were among those targeted. Foreign office minister for cyber Lord Ahmad of Wimbledon said the hackers sought to steal intellectual property “to make money and gain technological advantage at our expense”.

The hackers were not accused of being directly employed by Iran’s government. They were instead charged with criminal conduct waged primarily through the Mabna Institute on behalf of the Islamic Revolutionary Guard Corps, the elite military force assigned to defend Iran’s Shia theocracy from internal and external threats.

There was no immediate response to the charges and sanctions in Iran’s state-run media.

Friday’s actions are part of an effort by senior cybersecurity officials at the White House and across the US government to blame foreign countries for malicious hacks.

They were announced a day after US president Donald Trump named John Bolton, a former US ambassador to the UN who is deeply sceptical of the 2015 international nuclear accord with Iran, as his new national security adviser. The Department of Justice on Friday privately warned major internet infrastructure companies to expect attacks from Iran, an executive at one company who received the alert said. The officials said the most likely retaliation would be denial of service attacks on websites, which are not destructive but disrupt commerce and communication.

The sanctions and charges were the fourth time in the past few months that the Trump administration has blamed a foreign government for major cyber attacks, a practice that was relatively rare under the Obama administration.

The Treasury Department also placed sanctions on another Iranian, Behzad Mesri. Sometimes known as “Skote Vahshat,” Mr Mesri was charged in 2017 with hacking cable TV network HBO to leak unaired episodes of the fantasy drama Game of Thrones. Mr Mesri is still at large, officials said.

The Obama administration in 2016 indicted seven Iranians for distributed-denial-of-service attacks on dozens of US banks and for trying to shut down a New York dam. Those hackers were also accused of working on behalf of Iran’s government.

None of the Iranians indicted in 2016 have been arrested or extradited, a justice department spokesman said. – Reuters/PA</s>The Department of Justice (DOJ) and Department of Treasury’s Office of Foreign Assets Control (OFAC) charged one Iranian entity and nine Iranians on Friday in a hacking scheme to steal intellectual property and information from at least 144 United States-based universities, various companies, and government agencies for private financial gain.

The DOJ charged Gholamreza Rafatnejad, 38; Ehsan Mohammadi, 37; Abdollah Karima, aka Vahid Karima, 39; Mostafa Sadeghi, 28; Seyed Ali Mirkarimi, 34; Mohammed Reza Sabahi, 26; Roozbeh Sabahi, 24; Abuzar Gohari Moqadam, 37; and Sajjad Tahmasebi, 30, under Executive Order (E.O.) 13694 for “Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities.”

The stolen data and stolen login credentials acquired through the hacking were reportedly used to benefit Iran’s Islamic Revolutionary Guard Corps (IRGC).

‘These nine Iranian nationals allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 American companies, five American government agencies, and also more than 176 universities in 21 foreign countries,” Deputy Attorney General Rod Rosenstein said in a press release. “For many of these intrusions, the defendants acted at the behest of the Iranian government and, specifically, the Iranian Revolutionary Guard Corps.

Iran is engaged in an ongoing campaign of malicious cyber activity against the United States and our allies. The IRGC outsourced cyber intrusions to The Mabna Institute, a hacker network that infiltrated hundreds of universities to steal sensitive data. We will not tolerate the theft of U.S. intellectual property, or intrusions into our research institutions and universities. Treasury will continue to systematically use our sanctions authorities to shine a light on the Iranian regime’s malicious cyber practices, and hold it accountable for criminal cyber-attacks.

According to the Treasury Department:

The Mabna Institute is an Iran-based company that engaged in the theft of personal identifiers and economic resources for private financial gain. The organization was founded in or about 2013 to assist Iranian universities and scientific and research organizations in obtaining access to non-Iranian scientific resources. The Mabna Institute also contracted with Iranian governmental and private entities to conduct hacking activities on its behalf.

In addition to the designations related to the activities of the Mabna Institute, OFAC also designated Behzad Mesri, 29, known as “Sokoote Vahshat” (which means “Silent Fear” in Persian), for “engaging in significant malicious cyber-enabled misappropriation of economic resources, personal identifiers, and financial information for private financial gain for activities targeting a U.S. media company.”

Mesri was hit with criminal charges, accused of hacking HBO and prematurely releasing several Game of Thrones scripts, episodes of Curb Your Enthusiasm, and private executive emails.

In December 2015, a Santa Barbara lead security researcher discovered that Iranian hackers were behind the hacking of housing files at the University of California, Santa Barbara.

Adelle Nazarian is a politics and national security reporter for Breitbart News. Follow her on Facebook and Twitter.</s>The United States on Friday charged nine Iranians and an Iranian company with attempting to hack into hundreds of U.S. and international universities , dozens of companies and parts of the U.S. government on behalf of the Tehran government. From a report:</s>The Trump administration in the United States on Friday charged nine Iranians and an Iranian company with attempting to hack into hundreds of U.S. and international universities, dozens of companies and parts of the U.S. government on behalf of the Iranian government.

The cyberattack pilfered more than 31 terabytes of academic data and intellectual property from 144 U.S. universities and 

 176 universities in 21 foreign countries, the U.S. Department of Justice said in a statement.

 

 The U.S. Treasury Department said on its website that it was placing sanctions on those accused and the Mabna Institute, a company described by U.S. prosecutors as designed to help Iranian research organizations steal information.</s>Federal agencies issued criminal charges and sanctions Friday against nine Iranians accused of hacking sensitive information from hundreds of universities, private companies and U.S. government entities.

The Iranian defendants, accused of working at the behest of the Iranian government-tied Islamic Revolutionary Guard Corps, hacked the computer systems of about 320 universities in the U.S. and abroad to steal expensive science and engineering research that was then used by the Iranian government or sold for profit, prosecutors said.

More than 100,000 professors worldwide were targeted with spear-phishing emails, making the hacking scheme one of the largest state-sponsored cybercrime cases ever charged by the Justice Department, the Wall Street Journal reported.

The affected professors and universities were not identified.

The Justice Department said the hackers stole roughly 31 terabytes of academic research and intellectual property that was then sent to servers outside the United States for profit. That amount of data is said to far exceed the total content of the Library of Congress.

“Just in case you’re wondering, they’re not admiring our work,” FBI Deputy Director David Bowdich said. “They’re stealing it, and they’re taking credit for it, and they’re selling it to others.”

The information that was stolen, which was sold through two websites to customers in Iran, cost U.S. universities about $3.4 billion to procure and access.

The hackers are also accused of breaking into the networks of government organizations, including the Department of Labor, the Federal Energy Regulatory Commission, the United Nations and private sector entities, including 36 American companies, the Journal reported.

The Justice Department said the hackers were affiliated with an Iranian organization called the Mabna Institute, founded by two of the defendants, which prosecutors said contracted with the Iranian government to steal scientific research from other countries.

“By bringing these criminal charges, we reinforce the norm that most of the civilized world accepts: Nation-states should not steal intellectual property for the purpose of giving domestic industries an advantage,” Deputy Attorney General Rod Rosenstein said in announcing the charges.

The defendants are unlikely to ever be prosecuted in an American courtroom since there’s no extradition treaty with Iran. But the grand jury indictment, filed in a federal court in New York City, is part of the government’s “name and shame” strategy to publicly identify foreign hackers, block them from traveling without risk of arrest and put their countries on notice.

“People travel. They take vacations, they make plans with their families,” Bowdich said. “Having your name, face and description on a ‘Wanted’ poster makes moving freely much more difficult.”

On Friday, the U.S. Treasury Department also imposed sanctions against the nine defendants and the Mabna Institute, the Journal reported. The sanctions block their access to U.S. companies and entities, including financial transactions.

Tehran responded with Bahram Ghasemi, spokesman for the Foreign Ministry, condemning the move and calling it “provocative, illegal and without justification.”

Ghasemi said the charges are “another sign of hostility of the U.S. government towards Iranian nation.” He said the U.S will not take any benefit from the move aimed at “thwarting” scientific growth of Iran.

The Associated Press contributed to this report.</s>The United States’ Justice Department on Friday announced charges against 9 Iranians in a government-sponsored hacking scheme that pilfered sensitive information from hundreds of universities, private companies and government agencies.

The Iranian defendants are accused of working at the behest of the Islamic Revolutionary Guard Corps to steal large quantities of academic data from hundreds of universities in the United States and abroad as well as email accounts belonging to employees of government agencies and private companies.

Prosecutors say the defendants were affiliated with the Mabna Institute, an Iranian company that since at least 2013 has contracted with the Iranian government to conduct hacking.

The defendants are unlikely to ever be prosecuted in an American courtroom since there’s no extradition treaty with Iran. But the case is part of the government’s “name and shame” strategy to publicly identify foreign hackers and put their countries on notice.

Also Friday, the Treasury Department designated the Mabna Institute and the nine Iranians for sanctions.

“Today, not only are we publicly identifying the foreign hackers who committed these malicious cyber intrusions, but we are also sending a powerful message to their backers, the Government of the Islamic Republic of Iran: your acts do not go unnoticed,” FBI Director Christopher Wray said in a statement.

“We will protect our innovation, ideas and information, and we will use every tool in our toolbox to expose those who commit these cybercrimes. Our memory is long; we will hold them accountable under the law, no matter where they attempt to hid,” he added.</s>Washington (AFP) - The United States imposed sanctions on Friday on 10 Iranians and an Iranian company for alleged hacking of hundreds of universities in the US and abroad and the theft of "valuable intellectual property and data."

The Mabna Institute "engaged in the theft of personal identifiers and economic resources for private financial gain" and for the benefit of Iran's Islamic Revolutionary Guard Corps, the US Treasury Department said.

The two founders of the Mabna Institute were among the 10 people whose assets are subject to US seizure, it said.

The Justice Department said nine of the 10 had been indicted separately for conspiracy to commit computer intrusions and other crimes.

Since 2013, the Mabna Institute carried out cyber intrusions into the computer systems of 144 US universities, the Treasury Department said, and 176 universities in 21 foreign countries.

"For many of these intrusions, the defendants acted at the behest of the Iranian government and, specifically, the Iranian Revolutionary Guard Corps, Deputy Attorney General Rod Rosenstein said in a statement.

"The Department of Justice will aggressively investigate and prosecute hostile actors who attempt to profit from America's ideas by infiltrating our computer systems and stealing intellectual property," Rosenstein added.</s>
• The Department of Justice just announced charges against nine Iranians for an elaborate hacking scheme that targeted more than 140 US universities.

The US charged nine Iranians with cyber attacks against more than 350 entities around the world, mostly universities, on behalf of the Iranian government, Deputy Attorney General Rod Rosenstein announced Friday.

The indictment charged Gholamreza Rafatnejad, 38; Ehsan Mohammadi, 37; Abdollah Karima, akalso known asa Vahid Karima, 39; Mostafa Sadeghi, 28; Seyed Ali Mirkarimi, 34; Mohammed Reza Sabahi, 26; Roozbeh Sabahi, 24; Abuzar Gohari Moqadam, 37; and Sajjad Tahmasebi, 30, all citizens and residents of Iran, for the attacks.

Those defendants were all connected to the Mabna Institute, an Iranian company that has conducted cyber attacks on the more than 360 entities, which included 144 US universities, 176 universities on foreign soil, 47 domestic and foreign private companies, and government bodies such as the US Department of Labor and the United Nations.

The indictment alleges that the defendants stole more than 31 terabytes of academic data and intellectual property from the universities, worth more than $3 billion. The Treasury Department levied sanctions against the Mabna Institute and the defendents, which came in addition to the criminal charges filed by the Justice Department.

"For many of these intrusions, the defendants acted at the behest of the Iranian government and, specifically, the Iranian Revolutionary Guard Corps," Rosenstein said in a press conference. "The Department of Justice will aggressively investigate and prosecute hostile actors who attempt to profit from America's ideas by infiltrating our computer systems and stealing intellectual property. This case is important because it will disrupt the defendants' hacking operations and deter similar crimes."

The defendents were charged with computer fraud, wire fraud, conspiracy, and identity theft. Rosenstein added that the stolen information was then used or sold by the Iranian government.
The United States charges and sanctions nine Iranians and the Iranian company Mabna Institute for hacking and attempting to hack hundreds of universities.