US expands Iran-linked hacking case to 17 defendants over HBO’s $6 million Bitcoin ransom plot

US expands Iran-linked hacking case to 17 defendants over HBO’s $6 million Bitcoin ransom plot

US authorities say the alleged Iran network compromised thousands of academic accounts and caused millions in remediation costs.

Quick Take

01 US prosecutors expanded the Iran-linked Mabna hacking case to 17 defendants, adding six accused of involvement in HBO’s 2017 Bitcoin extortion attempt.

02 The alleged campaign compromised about 8,000 academic accounts, stole 31.5 terabytes of data, and caused more than $20 million in costs.

03 Authorities say HBO’s ransom demand reached roughly $6 million, but the indictment does not allege payment and offers rewards for information.

US prosecutors have expanded an eight-year-old hacking case tied to Iran’s Islamic Revolutionary Guard Corps , adding eight defendants and linking six of them to the 2017 HBO breach that included a $6 million Bitcoin extortion attempt.

A 14-count second superseding indictment unsealed Aug. 18 charges 17 people connected to Iran-based Mabna Institute, up from nine defendants named when the Justice Department first brought the case in 2018.

Prosecutors allege Mabna operated as a private company that carried out cyber intrusions on behalf of the IRGC and other Iranian government, university and private-sector clients.

Six of the newly added defendants, including Behzad Mesri, Saeid Houshyar, Manouchehr Hashemloo, Keyvan Fayaz, Saber Shahbazi Ballojeh and Arman Kahzadian, are accused of participating in the 2017 HBO intrusion.

That breach led to an attempted Bitcoin extortion after hackers allegedly stole unreleased television episodes, scripts, and other proprietary material.

Prosecutors said the demand began at $5.5 million and rose to roughly $6 million before stolen HBO content was leaked online.

The Justice Department has not alleged that HBO paid the ransom.

The signal, before the noise.

Start your day with the crypto stories moving markets, decoded by CryptoSlate’s editors.

Weekday mornings

5-minute read

One email. Everything that matters.

Free to join. Unsubscribe any time.

Mesri had previously been charged separately over the HBO attack in 2017. The new indictment brings that episode into the broader Mabna prosecution rather than alleging a fresh breach.

Wider campaign targeted universities and government victims

Meanwhile, the Mabna operation extended well beyond HBO.

Prosecutors allege the group targeted more than 100,000 professor accounts and successfully compromised about 8,000, stealing at least 31.5 terabytes of academic data and intellectual property through activity that continued until at least December 2017.

The government also alleges Galekuhi, Fayaz and Ballojeh participated in attacks against private-sector and government organizations that caused more than $20 million in investigation and remediation costs.

Alongside the indictment, the State Department’s Rewards for Justice program offered rewards of up to $10 million for information leading to the location of Mesri, Galekuhi, Kahzadian, Fayaz and Ballojeh.

The superseding indictment marks the latest effort by US authorities to widen the case against an alleged Iranian cyber network first charged nearly a decade ago, while tying one of its most prominent alleged operations — the HBO hack — directly into the broader prosecution.

US Treasury Department blacklists Bitcoin addresses linked to Iran ransomware group

Mentioned in this article

Editorial credits

Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.

Related coverage

Adam Back’s Bitcoin treasury deal died, but its $15M obligation did not

More coverage

FBI gets alleged $165 million crypto Ponzi scheme mastermind back after year-long Fiji escape

A $22.9 million capital deficit threatens to derail an energy firm’s pivot to off-grid Bitcoin mining

Unresolved $11 million liquidity crash leaves pools exposed as attacker still holds 20.83 BTC on Maya Protocol

CryptoSlate may use AI tools to support research, editing, and production workflows. Our journalism remains human-led, with our editorial team responsible for every published article. Read our full AI usage disclaimer .

Our writers' opinions are solely their own and do not reflect the opinion of CryptoSlate. None of the information you read on CryptoSlate should be taken as investment advice, nor does CryptoSlate endorse any project that may be mentioned or linked to in this article.

Buying and trading cryptocurrencies should be considered a high-risk activity. Please do your own due diligence before taking any action related to content within this article. Finally, CryptoSlate takes no responsibility should you lose money trading cryptocurrencies. For more information, see our company disclaimers .

Follow the signal