The Justice Department has unsealed a 14-count superseding indictment naming 17 alleged members of the Iran-based Mabna Institute. DOJ says the university spearphishing campaign was conducted on behalf of the IRGC. Nine defendants were charged in 2018; eight are newly added.
According to the allegations, the university campaign targeted more than 100,000 professor accounts, compromised approximately 8,000 of them, and resulted in the theft of at least 31.5 terabytes of research and intellectual property.
The access story is less exotic.
Personalized phishing. Lookalike login pages. Password spraying. Compromised credentials passed between operators. Valid accounts used to retrieve data that those accounts were already trusted to reach.
The objective was strategic. The login was ordinary.
The indictment contains allegations, not findings of guilt; every defendant is presumed innocent. It also does not say Mabna obtained credentials from breach dumps or criminal markets. The case supports a narrower point: state-linked objectives can still depend on familiar credential failures.
DOJ's allegations connect familiar credential routes to strategic data theft. The figures are allegations, not findings of guilt.
The expanded case still starts with a login
The Justice Department's 2018 account described a deliberate university workflow.
The alleged operators first researched professors and their published work. They then sent personalized messages that appeared to come from another academic. Links led to domains designed to resemble the victim's university and pages made to look like its login screen. Entered credentials were captured and used to obtain research and academic material.
Against private companies and government organizations, DOJ alleged a second route: collect employee names and email addresses from open sources, then try commonly used or default passwords across many accounts. That is password spraying—testing a small number of likely passwords against a large population to avoid the noise and lockouts produced by hammering one account.
The 2026 superseding case adds eight defendants and again describes password-spray attacks and exfiltration. It also alleges that one defendant tracked spearphishing, created target lists, crafted messages, and exchanged compromised logins.
The signed superseding indictment adds a distinct continuation. From approximately October 2018 through March 2022, three defendants allegedly reused password spraying against companies and government entities, and sought to monetize compromised credentials through dark-web forums. That direction matters: the credential market was an alleged output of the intrusions, not the documented source of the passwords.
The account was the delivery mechanism.
Three credential supplies, one trusted session
Credential attacks are often flattened into one category, but the supply routes are different.
Phishing captures a secret from the user through a deceptive sign-in experience.
Password spraying tries a few common or default passwords across many known accounts.
Credential stuffing takes username-and-password pairs exposed elsewhere and tests whether password reuse makes them valid on another service.
The Mabna allegations support the first two routes. They do not publicly establish the third.
Leaks and dumps still belong in the defensive model. In a 2022 warning to academic institutions, the FBI said it had observed stolen higher-education credentials posted on publicly accessible forums and offered through criminal markets. The bureau also identified more than 36,000 .edu email-and-password combinations posted in 2021, while cautioning that some may have been duplicates. Its warning was direct: password reuse can turn credentials exposed in one place into successful access somewhere else.
NIST SP 800-63B requires conforming verifiers and credential service providers to check new passwords against blocklists containing common, expected, and compromised values, including passwords from previous breach corpora. Previous breaches already document which password choices recur.
The source changes. The resulting sign-in can look the same.
Breach dumps belong in the defensive model, but DOJ does not allege that they supplied credentials for this campaign.
Valid accounts make theft look routine
A stolen credential does not need to break the target system. It asks the target system to work as designed—for the wrong person.
DOJ alleges that compromised professor accounts were used to retrieve material those identities could legitimately access. One affiliated service allegedly allowed customers to use compromised professor accounts to reach university library systems directly. In corporate and government victims, the earlier case alleged that entire mailboxes were taken and, in some cases, forwarding rules were created to capture future messages.
Additional consequential evidence can appear after authentication: a new location, unfamiliar device, unusual library retrieval, mailbox export, forwarding rule, OAuth grant, MFA-method change, or access pattern that does not fit the owner.
A successful login is an authentication result. It is not proof of a legitimate user.
The strongest evidence may appear after authentication, when a valid account behaves unlike its owner.
An attacker operating through a real account inherits the trust and visibility gaps already attached to that identity.
Make old credentials stop working
Reduce the power of a captured, guessed, or recycled password.
Start with authentication. CISA identifies FIDO/WebAuthn as the widely available phishing-resistant option because authentication is bound to the legitimate service rather than handed to a lookalike page. Prioritize email, VPN, SSO, privileged administration, research repositories, and library or publishing access. Where phishing-resistant authentication cannot be deployed immediately, number matching is a stronger interim control than blind push approval.
Then close the password routes that remain:
reject common and previously compromised passwords, allow password managers, and rate-limit failed attempts;
eliminate default credentials and prevent password reuse across institutional services;
detect a small set of candidate passwords spread across many usernames, not just repeated failures against one user;
treat a confirmed credential exposure as an incident trigger rather than waiting for a successful intrusion alert; and
after compromise, reset the secret, revoke sessions and tokens, review MFA registrations, mailbox forwarding, OAuth grants, and prove that forced reauthentication occurred.
Microsoft's password-spray investigation guidance makes the same containment boundary explicit: identity recovery includes examining affected data, blocking compromised access, and checking for persistence such as forwarding rules or delegated mailbox access.
A reset changes a password. It does not erase prior access or necessarily terminate every existing session, and it cannot establish what the account did while it was controlled.
Recovery means invalidating every remaining path to the account and proving that the old access no longer works.
Research access belongs inside the identity boundary
Universities combine valuable data with fluid identity populations: faculty, students, visiting researchers, contractors, alumni, partners, publishers, and federated services. Collaboration is the operating model—and why a seemingly narrow account can bridge into expensive research or private correspondence.
Those identities need controls sized to the data behind them, not the application's administrative label. Prioritize phishing-resistant authentication for high-value research and email accounts. Expire dormant and guest access. Join authentication telemetry with post-login behavior. Treat exposed credentials as a trigger to review every service where reuse or federation could carry the identity.
The DOJ's new charges broaden the alleged network. They do not reveal a revolutionary entry technique. The university campaign described by the government ran from approximately 2013 through at least December 2017, and the mechanics were already familiar then.
They remain familiar because they still work.
The lesson is not that the attackers invented a new technique. It is that institutions still leave password-based access powerful enough to enable new theft.
Sources
U.S. Department of Justice — 17 Iranians charged in superseding Mabna Institute indictment
U.S. Attorney's Office, SDNY — 2026 superseding indictment announcement
U.S. Attorney's Office, SDNY — 2018 Mabna Institute indictment announcement and credential methods
FBI/IC3 — Compromised U.S. academic credentials identified across public and criminal forums
NIST SP 800-63B — Authentication and authenticator management