US expands Iran-linked hacking case to 17 defendants over HBO’s $6 million Bitcoin ransom plot

US prosecutors have expanded an eight-year-old hacking case tied to Iran’s Islamic Revolutionary Guard Corps, adding eight defendants and linking six of them to the 2017 HBO breach that included a $6 million Bitcoin extortion attempt.

A 14-count second superseding indictment unsealed Aug. 18 charges 17 people connected to Iran-based Mabna Institute, up from nine defendants named when the Justice Department first brought the case in 2018.

Prosecutors allege Mabna operated as a private company that carried out cyber intrusions on behalf of the IRGC and other Iranian government, university and private-sector clients.

Six of the newly added defendants, including Behzad Mesri, Saeid Houshyar, Manouchehr Hashemloo, Keyvan Fayaz, Saber Shahbazi Ballojeh and Arman Kahzadian, are accused of participating in the 2017 HBO intrusion.

That breach led to an attempted Bitcoin extortion after hackers allegedly stole unreleased television episodes, scripts, and other proprietary material.

Prosecutors said the demand began at $5.5 million and rose to roughly $6 million before stolen HBO content was leaked online.

The Justice Department has not alleged that HBO paid the ransom.

Mesri had previously been charged separately over the HBO attack in 2017. The new indictment brings that episode into the broader Mabna prosecution rather than alleging a fresh breach.

Wider campaign targeted universities and government victims

Meanwhile, the Mabna operation extended well beyond HBO.

Prosecutors allege the group targeted more than 100,000 professor accounts and successfully compromised about 8,000, stealing at least 31.5 terabytes of academic data and intellectual property through activity that continued until at least December 2017.

The government also alleges Galekuhi, Fayaz and Ballojeh participated in attacks against private-sector and government organizations that caused more than $20 million in investigation and remediation costs.

Alongside the indictment, the State Department’s Rewards for Justice program offered rewards of up to $10 million for information leading to the location of Mesri, Galekuhi, Kahzadian, Fayaz and Ballojeh.

The superseding indictment marks the latest effort by US authorities to widen the case against an alleged Iranian cyber network first charged nearly a decade ago, while tying one of its most prominent alleged operations — the HBO hack — directly into the broader prosecution.