The U.S. Department of Justice charged 17 Iranian nationals in connection with a sweeping cyber extortion scheme that targeted HBO, universities, companies and government agencies, with demands made in Bitcoin.
The defendants allegedly conducted the campaign on behalf of Iran's Islamic Revolutionary Guard Corps. The indictment unseals charges tied to intrusions spanning years, including the 2015 breach of Sony Pictures and the theft of proprietary data from dozens of U.S. and international entities. The $6 million figure represents Bitcoin extortion demands made during the HBO operation alone.
The defendants are accused of operating under the banner of the Mabna Institute, a front organization used to conduct cyber theft on behalf of the IRGC's Quds Force unit. Court filings describe a systematic approach: the group would breach networks, extract sensitive data, and then demand ransom in Bitcoin or threaten to release the stolen materials publicly. In the HBO case, attackers demanded $6 million after obtaining scripts, financial information and employee data.
The indictment connects this cyber campaign to earlier intrusions that drew public attention. The 2015 Sony Pictures breach, attributed to North Korea at the time, is now charged alongside attacks on universities and private companies. Prosecutors allege the Mabna Institute coordinated hundreds of intrusions targeting American and allied institutions, stealing intellectual property, research data and credentials that could be weaponized for further breaches.
Many of the 17 defendants are believed to remain in Iran and outside U.S. custody. The charges carry maximum sentences of up to 10 years per count, though extradition is unlikely given the absence of a U.S.-Iran extradition treaty. The indictment includes charges for wire fraud, unauthorized computer access and money laundering related to the Bitcoin payments.
The action continues sustained U.S. law enforcement focus on Iranian cyber operations targeting the private sector and government networks. Similar indictments have been filed in prior years as the FBI and Justice Department have increased coordination with international partners to identify and prosecute state-sponsored actors. The Bitcoin component of the extortion scheme shows how Iranian threat groups have adapted techniques to exploit cryptocurrency's pseudonymity, though on-chain analysis and cooperation from exchange operators have increasingly enabled investigators to trace ransom flows.
The operation involved 17 individuals within the IRGC's cyber apparatus rather than freelance operators. The 2015 Sony Pictures breach caused hundreds of millions in damages and prompted a major policy response from the Obama administration, making the formal charging of actors tied to that intrusion a significant closure on a decade-old incident.
