Iran's Mabna Institute Conducted Decade-Long Spearphishing Campaign Against University Professors

Iran's Mabna Institute ran a 3-phase spearphishing campaign against university professors for a decade. The 50-page superseding indictment has more methodological detail than the press coverage suggests. The U.S. Department of Justice unsealed a 14-count indictment in March 2024, adding 8 defendants to a 2018 case and extending the campaign timeline to at least March 2022. The operation involved three phases: open-source reconnaissance of professors, spearphishing emails with typosquatted domains to steal credentials, and exfiltration of academic materials while maintaining persistent access. Stolen data was resold inside Iran via websites like Megapaper.ir and Gigapaper.ir, with some defendants linked to both Iran’s cyber police (FATA) and the Supreme Leader’s office.