The US charged 17 Iranians over a years-long hacking campaign that stole 31TB from universities, companies and government agencies worldwide. Eight years after the original indictment first went public, US prosecutors just added eight more names to the list. The Justice Department unsealed a superseding indictment this week charging 17 members of the Mabna Institute, an Iran-based operation running hacking campaigns since at least 2013 on behalf of Iran’s Islamic Revolutionary Guard Corps and other government and university clients. According to DoJ, the group compromised systems at 144 US universities and 178 foreign ones, plus at least 42 US private companies, 11 foreign companies, five federal and state government agencies, and two nongovernmental organizations. They pulled more than 31 terabytes of academic data and intellectual property out of those systems, along with entire employee email inboxes wherever they had access. “The Mabna Institute stole more than 31 terabytes of academic data and intellectual property from these universities, as well as the email accounts of employees at the private sector companies, government agencies, and NGOs.” reads the press release published by DoJ. “The defendants conducted many of these intrusions on behalf of the Islamic Republic of Iran’s Islamic Revolutionary Guard Corps (IRGC), one of several entities within the government of Iran responsible for gathering intelligence, as well as other Iranian government and university clients. Nine of the 17 defendants charged in the S2 indictment were previously charged in a 7-count indictment announced in March 2018. The case is assigned to U.S. District Judge Jesse M. Furman.” The hackers targeted more than 100,000 professor accounts worldwide and broke into about 8,000 of them in around 24 countries. They used stolen credentials to access research papers, theses, dissertations and academic journals, which were then sold online. The stolen material was offered through websites such as Megapaper.ir and Gigapaper.ir. Customers could buy academic resources or use compromised professor accounts to access university libraries. The operation turned stolen academic credentials and research into a profitable business. One name on the new charge sheet connects this case to something much more publicly memorable. Behzad Mesri, listed among the newly added defendants, was separately charged years ago with breaking into HBO’s systems, stealing proprietary data, and attempting to extort the company for roughly $6 million in Bitcoin. This indictment ties him and four co-defendants to that same intrusion as part of the broader Mabna Institute operation, connecting a headline-grabbing entertainment industry hack to a much larger state-linked espionage campaign. The financial damage extends well beyond stolen research. According to the indictment, other defendants ran password spray attacks against private companies and at least two government entities, causing victims to spend more than $20 million investigating and cleaning up after the intrusions. ““Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” said U.S. Attorney Jamie McDonald for the Southern District of New York. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad. Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength. This office and our partners will continue to protect American innovation and pursue accountability for the individuals behind these attacks.”” Five of the newly charged defendants, Mesri, Galekuhi, Kahzadian, Fayaz, and Ballojeh, now carry a combined bounty attached to their names. The State Department’s Rewards for Justice program is offering up to $10 million for information leading to their location, funneled through a Tor-based tip line for anyone willing to share what they know. Given that most of these defendants are almost certainly still in Iran and unlikely to face a US courtroom anytime soon, that reward is really the only lever prosecutors currently have. An indictment isn’t a conviction, and every defendant here remains legally presumed innocent unless proven otherwise in court. But the FBI’s own framing of the case makes the intended message pretty clear regardless of what happens next: eight years between the original charges and this expanded version isn’t hesitation, it’s the department demonstrating that an open case file doesn’t have an expiration date, even when the people on it never set foot on American soil. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iranians) Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iranians)
Microsoft is investigating a potential issue with the August 2026 updates that may prevent some games from launching or cause them to crash on affected Windows 11 systems. The confirmation follows user reports that a limited number of games, including ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals, become unresponsive on devices running Windows 11, version 25H2, and Windows 11, version 24H2. The complete list of symptoms users are experiencing on impacted systems includes: "Following the release of Windows updates on August 11, 2026 (KB5121003) and later, Microsoft received reports of issues involving inability to run games as expected," Microsoft said in a Windows release health dashboard update on Wednesday. "We are presently investigating to determine if this is an issue caused by Microsoft. We will provide an update when more information is available."
ChatGPT is experiencing a major outage, and users are unable to sign in, create accounts, or load chats, including previous conversations. The outage started at approximately 8 PM ET on Wednesday, August 19, and is affecting users worldwide, including those in the US and Europe. If you are affected, ChatGPT will get stuck at loading animations for the sidebar, and you won't be able to send messages due to "too many concurrent requests" errors. New signups and logins on chatgpt.com are also failing. This outage also affects OpenAI's coding platform, Codex. Thankfully, OpenAI is aware of these issues and has already acknowledged them on the status page. OpenAI says it has identified that users are running into login issues across the impacted services, and that it is "working on implementing a mitigation."
The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published from the same owner
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. These clusters include UNC6293, UNC7005, and UNC5976. "These clusters engage in persistent, adaptive
A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do. Signed drivers get turned against defenses. Legitimate apps help malware blend in. A weak header check opens a path to code execution. Elsewhere, exposed systems, old bugs, odd hiding tricks, and AI-assisted exploit research keep lowering the effort needed to cause damage. Nothing here needs
The U.S. government on Wednesday warned of an "active threat" targeting critical infrastructure organizations in the country using artificial intelligence (AI)-generated exploit scripts. The activity is targeting Siemens S7 SeriesProgrammable Logic Controllers (PLCs) to conduct reconnaissance and capability development using AI-generated scripts disguised as legitimate monitoring tools. That
Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page. The AI security company, which has codenamed the technique "Cryptographic Context Injection," said the
Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability. According to the cloud computing and virtualization technology company, the issues affect customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds, as well as SecurAccess
A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerability in question is CVE-2026-73570 (CVSS score: 8.9), which refers to a case of command injection that can lead to remote code execution. "A remote code execution vulnerability exists in Zimbra
Confirm this action.
Leaving now will discard your changes.