Nine Iranians Charged With Conducting Massive Cyber Theft Campaign On Behalf Of The Islamic Revolutionary Guard Corps

The U.S. Justice Department released the below information:

An Indictment charging Gholamreza Rafatnejad, 38; Ehsan Mohammadi, 37; Abdollah Karima, aka Vahid Karima, 39; Mostafa Sadeghi, 28; Seyed Ali Mirkarimi, 34; Mohammed Reza Sabahi, 26; Roozbeh Sabahi, 24; Abuzar Gohari Moqadam, 37; and Sajjad Tahmasebi, 30, all citizens and residents of Iran, was unsealed today.  The defendants were each leaders, contractors, associates, hackers-for-hire or affiliates of the Mabna Institute, an Iran-based company that, since at least 2013, conducted a coordinated campaign of cyber intrusions into computer systems belonging to 144 U.S. universities, 176 universities across 21 foreign countries, 47 domestic and foreign private sector companies, the U.S. Department of Labor, the Federal Energy Regulatory Commission, the State of Hawaii, the State of Indiana, the United Nations, and the United Nations Children’s Fund.  

Through the defendants’ activities, the Mabna Institute stole more than 31 terabytes of academic data and intellectual property from universities, and email accounts of employees at private sector companies, government agencies, and non-governmental organizations.  The defendants conducted many of these intrusions on behalf of the Islamic Republic of Iran’s (Iran) Islamic Revolutionary Guard Corps (IRGC), one of several entities within the government of Iran responsible for gathering intelligence, as well as other Iranian government and university clients.  In addition to these criminal charges, today the Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated the Mabna Institute and the nine defendants for sanctions for the malicious cyber-enabled activity outlined in the Indictment.

The charges were announced by Deputy Attorney General Rod J. Rosenstein; Assistant Attorney General for National Security John C. Demers; U.S. Attorney Geoffrey S. Berman for the Southern District of New York; FBI Director Christopher A. Wray; Assistant Director in Charge William F. Sweeney Jr. of the FBI’s New York Field Division; and Treasury Under Secretary for Terrorism and Financial Intelligence Sigal Mandelker.

“These nine Iranian nationals allegedly stole more than 31 terabytes of documents and data from more than 140 American universities, 30 American companies, five American government agencies, and also more than 176 universities in 21 foreign countries,” said Deputy Attorney General Rosenstein.  “For many of these intrusions, the defendants acted at the behest of the Iranian government and, specifically, the Iranian Revolutionary Guard Corps.  The Department of Justice will aggressively investigate and prosecute hostile actors who attempt to profit from America’s ideas by infiltrating our computer systems and stealing intellectual property.  This case is important because it will disrupt the defendants’ hacking operations and deter similar crimes.”

“Today, in one of the largest state-sponsored hacking campaigns ever prosecuted by the Department of Justice, we have unmasked criminals who normally hide behind the ones and zeros of computer code,” said U.S. Attorney Berman.  “As alleged, this massive and brazen cyber-assault on the computer systems of hundreds of universities in 22 countries and dozens of private sector companies and governmental organizations was conducted on behalf of Iran’s Islamic Revolutionary Guard.  The hackers targeted innovations and intellectual property from our country’s greatest minds.  These defendants are now fugitives from American justice, no longer free to travel outside Iran without risk of arrest.  The only way they will see the outside world is through their computer screens, but stripped of their greatest asset – anonymity.”  

“This investigation involved a complex threat in a dynamic landscape, but today’s announcement highlights the commitment of the FBI and our partners to vigorously pursue those that threaten U.S. property and security,” said Director Wray.  “Today, not only are we publicly identifying the foreign hackers who committed these malicious cyber intrusions, but we are also sending a powerful message to their backers, the Government of the Islamic Republic of Iran: your acts do not go unnoticed.  We will protect our innovation, ideas and information, and we will use every tool in our toolbox to expose those who commit these cyber crimes.  Our memory is long; we will hold them accountable under the law, no matter where they attempt to hide.”

According to the allegations contained in the Indictment unsealed today in Manhattan federal court:

Background on the Mabna Institute

Gholamreza Rafatnejad and Ehsan Mohammadi, the defendants, founded the Mabna Institute in approximately 2013 to assist Iranian universities and scientific and research organizations in stealing access to non-Iranian scientific resources.  In furtherance of its mission, the Mabna Institute employed, contracted, and affiliated itself with hackers-for-hire and other contract personnel to conduct cyber intrusions to steal academic data, intellectual property, email inboxes and other proprietary data, including Abdollah Karima, aka Vahid Karima, Mostafa Sadeghi, Seyed Ali Mirkarimi, Mohammed Reza Sabahi, Roozbeh Sabahi, Abuzar Gohari Moqadam, and Sajjad Tahmasebi.  The Mabna Institute contracted with both Iranian governmental and private entities to conduct hacking activities on their behalf, and specifically conducted the university spearphishing campaign on behalf of the IRGC.  The Mabna Institute is located at Tehran, Sheikh Bahaii Shomali, Koucheh Dawazdeh Metri Sevom, Plak 14, Vahed 2, Code Posti 1995873351.

University Hacking Campaign

The Mabna Institute, through the activities of the defendants, targeted more than 100,000 accounts of professors around the world.  They successfully compromised approximately 8,000 professor email accounts across 144 U.S.-based universities, and 176 universities located in foreign countries, including Australia, Canada, China, Denmark, Finland, Germany, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, Norway, Poland, Singapore, South Korea, Spain, Sweden, Switzerland, Turkey and the United Kingdom.  The campaign started in approximately 2013, continued through at least December 2017, and broadly targeted all types of academic data and intellectual property from the systems of compromised universities.  Through the course of the conspiracy, U.S.-based universities spent more than approximately $3.4 billion to procure and access such data and intellectual property.

The members of the conspiracy used stolen account credentials to obtain unauthorized access to victim professor accounts, which they used to steal research, and other academic data and documents, including, among other things, academic journals, theses, dissertations, and electronic books.  The defendants targeted data across all fields of research and academic disciplines, including science and technology, engineering, social sciences, medical, and other professional fields.  The defendants stole at least approximately 31.5 terabytes of academic data and intellectual property, which they exfiltrated to servers outside the United States that were under the control of members of the conspiracy.

In addition to stealing academic data and login credentials for the benefit of the Government of Iran, the defendants also sold the stolen data through two websites, Megapaper.ir (Megapaper) and Gigapaper.ir (Gigapaper).  Megapaper was operated by Falinoos Company, a company controlled by Abdollah Karima, aka Vahid Karima, the defendant, and Gigapaper was affiliated with Karima.  Megapaper sold stolen academic resources to customers within Iran, including Iran-based public universities and institutions, and Gigapaper sold a service to customers within Iran whereby purchasing customers could use compromised university professor accounts to directly access the online library systems of particular U.S.-based and foreign universities.

Accompanying Mitigation Efforts

Prior to the unsealing of the Indictment, the FBI provided foreign law enforcement partners with detailed information regarding victims within their jurisdictions, so that victims in foreign countries could be notified and foreign partners could assist in remediation efforts.

Also, in connection with the unsealing of the Indictment, today the FBI provided private sector partners detailed information regarding the vulnerabilities targeted and the intrusion vectors used by the Mabna Institute in their campaign against private sector companies.  This information will assist the public in its network defense and mitigation efforts.

*                *                *

  

Rafatnejad, Mohammadi, Karima, Sadeghi, Mirkarimi, Sabahi, Sabahi, Moqadam and Tahmasebi was each is charged with one count of conspiracy to commit computer intrusions, which carries a maximum sentence of five years in prison; one count of conspiracy to commit wire fraud, which carries a maximum sentence of 20 years in prison; two counts of unauthorized access of a computer, each of which carries a maximum sentence of five years in prison; two counts of wire fraud, each of which carries a maximum sentence of 20 years in prison; and one count of aggravated identity theft, which carries a mandatory sentence of two years in prison.  The maximum potential sentences in this case are prescribed by Congress and are provided here for informational purposes only, as any sentencings of the defendants will be determined by the assigned judge.

Mr. Rosenstein and Mr. Berman praised the outstanding investigative work of the FBI, the assistance of the United Kingdom’s National Crime Agency (NCA), and the support of the OFAC.  Assistant U.S. Attorneys Timothy T. Howard, Jonathan Cohen and Richard Cooper are in charge of the prosecution, with assistance provided by Trial Attorneys Heather Alpino and Jason McCullough of the National Security Division’s Counterintelligence and Export Control Section.

The charges contained in the Indictment are merely accusations and the defendants are presumed innocent unless and until proven guilty. 

Iranian General Boasts Of Quds Force Killing U.S. Troops In Iraq

Rowan Scarborough at the Washington Times offers a piece on an Iranian general bragging about Killing Americans

The deputy commander of Iran’s notorious Quds Force bragged at a recent ceremony that his operatives have killed more Americans than U.S. troops have killed Iranian fighters.

Brig. Gen. Ismail Ghaani was referring to Iran’s major intervention in the Iraq war to supply Shiite militias with supercharged explosives that could penetrate U.S. armored vehicles. The Pentagon has estimated the Quds Force, an arm of the Islamic Revolutionary Guard Corps, killed 500 Americans that way.

“Americans have suffered more losses from us then we have suffered losses from them,” Gen. Ghaani said, according to an article by Admad Majidyar, director of the Iran Observed Project at the Middle East Institute.

Mr. Majidyar wrote that the boasting came at a ceremony honoring the “martyred of the defenders of shrines” — Iran’s term for the militias it financed and trained in Iraq to fight the Islamic State and in Syria to support President Bashar Assad.

An Iranian opposition group has accused Iran of committing atrocities in Syria, particularly in the city of Aleppo, where thousands died under constant attacks by Syrian, Russian and Iranian forces.

“This, of course, is not only a confession but also outright bragging about how the Quds Force murdered Americans in Iraq,” said Michael Rubin, a Middle East analyst at the American Enterprise Institute. “It was the Quds Force, after all, that smuggled in explosively formed, armor-penetrating projectiles into Iraq for insurgents to incorporate in improved explosive devices.

You can read the rest of the piece via the below link:

http://www.washingtontimes.com/news/2017/aug/2/ismail-ghaani-iranian-general-boasts-of-quds-force/ 

Manssor Arbabsian Sentenced In New York City Federal Court To 25 Years In Prison For Conspiring With Iranian Military Officials To Assassinate The Saudi Arabian Ambassador To The United States

  

The U.S. Justice Department released the below information today:

 

 Manssor Arbabsiar, aka “Mansour Arbabsiar,” was sentenced today in New York City federal court to 25 years in prison for participating in a plot to murder the Saudi Arabian Ambassador to the U.S. while the Ambassador was in the U.S., announced John Carlin, Acting Assistant Attorney General for the National Security Division at the Department of Justice and Preet Bharara, U.S. Attorney for the Southern District of New York.

 

Arbabsiar, a 58 year-old naturalized U.S. citizen holding both Iranian and U.S. passports, was arrested on Sept. 29, 2011, at John F. Kennedy International Airport.  He pleaded guilty on Oct. 17, 2012, to one count of murder-for-hire, one count of conspiracy to commit murder-for-hire, and one count of conspiracy to commit an act of terrorism transcending national boundaries before U.S. District Judge John F. Keenan, who also imposed today’s sentence.

“Thanks to the collaborative efforts of many U.S. law enforcement and intelligence professionals, Manssor Arbabsiar is today being held accountable for his role in this assassination plot,” said Acting Assistant Attorney General for National Security John Carlin.  “I applaud all those responsible for ensuring that Arbabsiar and his co-conspirators in Iran’s Qods Force failed in their efforts.  Today’s sentencing serves as a reminder of the evolving threat environment we face.”

“Manssor Arbabsiar was an enemy among us – the key conduit for, and facilitator of, a nefarious international plot concocted by members of the Iranian military to assassinate the Saudi Ambassador to the United States and as many innocent bystanders as necessary to get the job done,” said U.S. Attorney Bharara.  “And but for the vigilance of our FBI and DEA partners, his plot, and the unspeakable harm it would have caused, may well have come to fruition, which is exactly why our commitment to using every resource we have to root out, prosecute and punish people like Arbabsiar, who act as emissaries for our enemies, remains unflagging.”
           
According to the complaint and indictment filed in federal court:

From the spring of 2011 to October 2011, Arbabsiar and his Iran-based co-conspirators, including members of Iran’s Qods Force, plotted the murder of the Saudi Arabian Ambassador to the U.S.  In furtherance of this conspiracy, Arbabsiar met on a number of occasions in Mexico with a DEA confidential source (CS-1) who posed as an associate of a violent international drug trafficking cartel.  Arbabsiar arranged to hire CS-1 and CS-1’s purported accomplices to murder the Ambassador with the awareness and approval of his Iran-based co-conspirators.  Arbabsiar wired approximately $100,000 to a bank account in the U.S. as a down payment to CS-1 for the anticipated killing of the Ambassador, which was to take place in the U.S, also with the approval of his co-conspirators.

The Qods Force is a branch of the Iranian Islamic Revolutionary Guard Corps (IRGC), which conducts sensitive covert operations abroad, including terrorist attacks, assassinations, and kidnappings, and is believed to have sponsored attacks against Coalition Forces in Iraq.  In October 2007, the U.S. Treasury Department designated the Qods Force as a terrorist supporter for providing material support to the Taliban and other terrorist organizations.

Arbabsiar met with CS-1 in Mexico on several occasions between May 2011 and July 2011.  During the course of these meetings, he inquired as to CS-1’s knowledge with respect to explosives and explained that he was interested in, among other things, attacking an embassy of Saudi Arabia and the murder of the Saudi Ambassador to the U.S.  In a July 14, 2011 meeting in Mexico, CS-1 told Arbabsiar that he would need to use at least four men to carry out the Ambassador’s murder and that his price for doing so was $1.5 million.  Arbabsiar agreed and stated that the murder of the Ambassador should be handled first, before the execution of other attacks that he had discussed with CS-1.  Arbabsiar also indicated that he and his associates had $100,000 in Iran to give CS-1 as a first payment toward the assassination.

During the same meeting, Arbabsiar also described to CS-1 his cousin in Iran, who he said had requested that Arbabsiar find someone to carry out the Ambassador’s assassination.  Arbabsiar indicated that his cousin was a “big general” in the Iranian military, that he focuses on matters outside of Iran, and that he had taken certain unspecified actions related to a bombing in Iraq.
In a July 17, 2011, meeting in Mexico, CS-1 noted to Arbabsiar that one of his workers had already traveled to Washington, D.C., to surveil the Ambassador. 

CS-1 also raised the possibility of innocent bystander casualties.  Arbabsiar made it clear that the assassination needed to go forward, despite mass casualties, telling CS-1, “They want that guy [the Ambassador] done [killed], if the hundred go with him f**k ‘em.”  CS-1 and Arbabsiar discussed bombing a restaurant in the U.S. that the Ambassador frequented.  When CS-1 noted that others could be killed in the attack, including U.S. senators who dine at the restaurant, Arbabsiar dismissed these concerns as “no big deal.”

On Aug. 1 and Aug. 9, 2011, Arbabsiar caused two overseas wire transfers totaling approximately $100,000 to be sent to an FBI undercover account as a down payment for CS-1 to carry out the assassination.  Later, Arbabsiar explained to CS-1 that he would provide the remainder of the $1.5 million after the assassination.  On Sept. 20, 2011, CS-1 told Arbabsiar that the operation was ready and requested that he either pay one half the agreed upon price ($1.5 million) for the murder or that Arbabsiar personally travel to Mexico as collateral for the final payment of the fee.  Arbabsiar agreed to travel to Mexico to guarantee final payment for the murder.

On Sept. 28, 2011, Arbabsiar flew to Mexico, and he was refused entry into the country and placed on a return flight destined for his last point of departure.  The following day, Arbabsiar was arrested by federal agents during a flight layover at JFK International Airport in New York.  Several hours after his arrest, Arbabsiar was advised of his Miranda rights and he agreed to waive those rights and speak with law enforcement agents.  During a series of Mirandized interviews, Arbabsiar confessed to his participation in the murder plot.

In addition, Arbabsiar admitted to agents that, in connection with this plot, he was recruited, funded, and directed by men he understood to be senior officials in Iran’s Qods Force.  He said these Iranian officials were aware of, and approved of, the use of CS-1 in connection with the plot, as well as payments to CS-1, the means by which the Ambassador would be killed in the U.S., and the casualties that would likely result.

Arbabsiar also told agents that his cousin, whom he had long understood to be a senior member of the Qods Force, had approached him in the early spring of 2011 about recruiting narco-traffickers to kidnap the Ambassador.  He told agents that he then met with CS-1 in Mexico and discussed assassinating the Ambassador.  Arbabsiar said that afterwards, he met several times in Iran with Gholam Shakuri, aka “Ali Gholam Shakuri,” a co-conspirator and Iran-based member of the Qods Force, and another senior Qods Force official, where Arbabsiar explained that the plan was to blow up a restaurant in the U.S. frequented by the Ambassador and that numerous bystanders would be killed.  According to Arbabsiar, the plan was approved by these officials.

In October 2011, after his arrest, Arbabsiar made phone calls at the direction of law enforcement to Shakuri in Iran that were monitored.  During these calls, Shakuri confirmed that Arbabsiar should move forward with the plot to murder the Ambassador and that he should accomplish the task as quickly as possible, stating on Oct. 5, 2011, “[j]ust do it quickly, it’s late…”  Shakuri also told Arbabsiar that he would consult with his superiors about whether they would be willing to pay CS-1 additional money.  Shakuri, who was also charged in the plot, remains at large.
*                *                *
In addition to the prison term, Arbabsiar was ordered to pay forfeiture in the amount of $125,000.
This case was investigated by the FBI Houston Division, the DEA Houston Division, and the FBI New York Joint Terrorism Task Force, with the assistance of the Department of Justice’s Office of International Affairs, its National Security Division, and the Department of State.  The Government of Mexico also cooperated with the investigation.

This case is being handled by the U.S. Attorney’s Office for the Southern District of New York, Terrorism and International Narcotics Unit.  Assistant U.S. Attorneys Glen Kopp, Edward Kim, and Stephen Ritchin are in charge of the prosecution with assistance from the Counterterrorism Section of the Justice Department’s National Security Division.