IRGC Cyber Theft Charges Sharpen UK Sanctions Exposure

The United States Department of Justice (DOJ) has unsealed a 14-count superseding indictment charging 17 members of the Mabna Institute, an Iran-based company alleged to have run a decade-long campaign of computer intrusions on behalf of the Islamic Revolutionary Guard Corps (IRGC) and other Iranian government and university clients. Nine of the defendants were named in an earlier 2018 indictment; eight are newly charged. The case sits before the US District Court for the Southern District of New York, and an indictment remains an allegation only.

The scale is material. Prosecutors allege the Mabna Institute targeted more than 100,000 professor accounts worldwide, compromising roughly 8,000 across 144 US-based and 178 foreign universities — the UK among the affected jurisdictions — and exfiltrating at least 31.5 terabytes of academic data and intellectual property. Beyond the university campaign, the defendants are said to have compromised employee email accounts at five US federal and state agencies, at least 42 US-based companies, and at least 11 foreign companies located in Germany, Italy, Switzerland, Sweden and the UK, together with the United Nations and the United Nations Children's Fund. Remediation costs at private sector victims are put in excess of $20 million. Separately, defendant Behzad Mesri was previously charged with intruding into Home Box Office, Inc. (HBO) and attempting to extort approximately $6 million in Bitcoin; five co-defendants are alleged to have participated in that intrusion.

The commercial architecture is the part that should hold attention. Stolen material was monetised through two Iranian websites, Megapaper.ir and Gigapaper.ir, the former operated by Falinoos Company, selling stolen academic resources and compromised-credential access to Iranian public universities and institutions. That is a revenue-generating criminal enterprise embedded within a state intelligence tasking, run through corporate vehicles with payment flows attached — precisely the structure that produces predicate offences under the Proceeds of Crime Act 2002 (POCA 2002) where funds touch UK-regulated firms.

The sanctions dimension has changed materially since the original 2018 charges. The IRGC is already subject to asset freeze, travel ban and director disqualification measures under the Iran (Sanctions) Regulations 2023. In July 2026 it became one of the first bodies designated under the National Security (State Threats) Act 2026, alongside the Islamic Movement of Companions of the Right (IMCR) and Russia's GRU Volunteer Corps, with support or assistance to a designated organisation carrying up to 14 years' imprisonment. Contracting entities that perform services for the IRGC therefore present layered exposure: financial sanctions breach reporting to the Office of Financial Sanctions Implementation (OFSI), potential terrorist-financing-adjacent reporting considerations, and criminal liability for facilitation.

For UK institutions, the practical read-across is threefold. Corporate email account takeover of the kind alleged is the standing precursor to payment fraud and mandate compromise, and should be treated as a financial crime typology rather than an information security matter alone. Front companies such as Falinoos Company demonstrate that state-tasked cyber operations monetise through ordinary-looking commercial entities, which argues for beneficial ownership scrutiny of counterparties in the academic publishing, research services and education-adjacent payments space. And the cryptoasset extortion element reinforces that virtual asset service providers should be screening for IRGC-linked exposure across counterparty and behavioural indicators, not designation matches alone.

The National Crime Agency (NCA) assisted the investigation, and the US Department of State's Rewards for Justice programme is offering up to $10 million for information on five of the defendants.

Read the press release here.