US charges 9 Iranians in massive hacking scheme – Defendants unlikely to ever be prosecuted as US has no extradition treaty with Iran

This image released by the FBI is the wanted posted for 9 Iranians that took part in a government-sponsored hacking scheme that pilfered sensitive information from hundreds of universities, private companies and government agencies. (FBI via AP)

By ERIC TUCKER,  Associated Press  WASHINGTON (AP) 03/24 — The Trump administration announced criminal charges and sanctions Friday against Iranians accused in a hacking scheme to pilfer sensitive information from hundreds of universities, private companies and American government agencies.

The nine defendants, accused of working at the behest of the Iranian government-tied Islamic Revolutionary Guard Corps, hacked the computer systems of about 320 universities in the United States and abroad to steal expensive science and engineering research that was then used by the government or sold for profit, prosecutors said.

The hackers also are accused of breaking into the networks of government organizations, such as the Department of Labor, the Federal Energy Regulatory Commission and the United Nations, and private sector entities including technology companies and law and consulting firms.

The Justice Department said the hackers were affiliated with an Iranian company called the Mabna Institute, which prosecutors say contracted with the Iranian government to steal scientific research from other countries. The institute was founded by two of the defendants.

“By bringing these criminal charges, we reinforce the norm that most of the civilized world accepts: nation-states should not steal intellectual property for the purpose of giving domestic industries an advantage,” Deputy Attorney General Rod Rosenstein said in announcing the charges.

Also Friday, the Treasury Department targeted the Mabna Institute and 10 Iranians — the nine defendants and one charged in a separate case last year — for sanctions that officials say will make it harder for them to do business outside Iran.

The defendants are unlikely to ever be prosecuted in an American courtroom since there’s no extradition treaty with Iran. But the grand jury indictment, filed in federal court in Manhattan, is part of the government’s “name and shame” strategy to publicly identify foreign hackers, block them from traveling without risk of arrest and put their countries on notice.

In Tehran, Bahram Ghasemi spokesman of the Foreign Ministry condemned the move and called it “provocative, illegal and without justification.”

Ghasemi said the charges are “another sign of hostility of the U.S. government towards Iranian nation.” He said the U.S will not take any benefit from the move aimed at “thwarting” scientific growth of Iran.

The approach has been employed with past indictments accusing Iranian hackers of a digital break-in of a New York dam, Chinese military officials of large-scale hacks at energy corporations and Russians of a massive breach of Yahoo user accounts.

“People travel. They take vacations, they make plans with their families,” said FBI Deputy Director David Bowdich. “Having your name, face and description on a ‘Wanted’ poster makes moving freely much more difficult.”

According to the indictment, the Iranians broke into universities through relatively simple but common means — tricking professors to click on compromised links.

The spear-phishing emails purported to be from professors at one university to those at another and contained what appeared to be authentic article links. But once clicked on, the links steered the professors to a malicious Internet domain that led them to believe they’d been logged out of their systems and that asked them to enter their log-in credentials.

Those credentials were logged and stolen by the hackers, prosecutors say.

The Justice Department says the hackers stole roughly 31 terabytes of academic research and intellectual property that was then sent to servers outside the United States for profit. The information that was stolen, which was sold through two websites to customers in Iran, cost U.S. universities about $3.4 billion to procure and access.

More than 100,000 professors worldwide were targeted with spear-phishing emails. The affected professors and their universities were not identified.

“Just in case you’re wondering, they’re not admiring our work,” Bowdich said. “They’re stealing it, and they’re taking credit for it, and they’re selling it to others.”

https://www.apnews.com/a49f880d279949a0a9ec52ff82b0db18/US-charges-9-Iranians-in-massive-hacking-scheme

Copyright 2018 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

Posted in: Crime & Criminals, Cybersecurity/Cybercrime, Data Security/Data Privacy, Dept. of Justice, Espionage, Federal Agencies, Identiy Theft, International Policing, Investigations, National Security

Leave a Reply

Your email address will not be published. Required fields are marked *

13 + sixteen =

Terms of Use for Posting Comments

Terms of Use

This site (the “Site”) is operated and maintained by Law Enforcement Education Foundation, Corporation (“Company”). Throughout the Site, the terms “we”, “us” and “our” refer to Company.  The words “user,” “you” and “your” as used herein refer to you.

Please read these terms and conditions of use (“Terms of Use”) carefully before contributing content. If you do not agree to these Terms of Use, please do not contribute content. Your use of the Site is subject to the Terms and Conditions found here .

By contributing content to the Site, you represent and warrant that you are at least eighteen (18) years old and that you have read and understand these Terms of Use and any amendments thereto and agree to be bound by them. If you are not at least eighteen (18) years old or you do not agree and accept these Terms of Use, you are prohibited from contributing content.

From time to time, we may permit users to submit content to the Site.  You hereby acknowledge and agree that by submitting remarks, comments, suggestions, ideas, graphics, feedback, edits, concepts, comments, photographs, illustrations and other materials (other than personal information and/or registration information) through the Site (individually and collectively, “Submissions”), you (i) grant us a nonexclusive, royalty-free, perpetual, transferable, irrevocable and fully sub-licensable right to use, reproduce, modify, adapt, translate, distribute, publish, create derivative works from and publicly display and perform such Submissions throughout the world in any media, now known or hereafter created, without attribution to you; (ii) grant us the right to pursue at law any person or entity that violates your and/or our rights in your Submissions; and (iii) forever waive any and all of your rights, including but not limited to moral rights, if any, in and to your Submissions, including, without limitation, any all rights or requirements of attribution or identification of you as the author of the Submission or any derivative thereof.  We reserve the right to remove any of your Submissions from the Site, in whole or in part, without notice to you, for any reason or no reason.

Submissions are made voluntarily. Any submissions which include personally identifiable information are subject to our Privacy Policy found here .  You may not upload or otherwise publish content on the Site that (i) is confidential to you or any third party; (ii) is untrue, inaccurate, false or other than an original work of your authorship; (iii) that relates to or impersonates any other person; (iv) violates the copyright, trademark, patent or other intellectual property rights of any person or entity; (v) contains any content, personally identifiable information or other information, or materials of any kind that relate or refer to any other person or entity other than the provider of the products, goods or services to which the Submission relates; or (vi) violates any law, or in any manner infringes or interferes with the rights of others, including but not limited to the use of names, information, or materials that (A) libel, defame, or invade the privacy of any third party, (B) are obscene or pornographic, (C) are harmful, threatening, offensive, abusive, harassing, vulgar, false or inaccurate, racially, sexually, ethnically or are otherwise objectionable or otherwise contrary to the laws of any place where such Submissions may be accessed; (D) constitute personal attacks on other individuals; (E) promote criminal, immoral or illegal activity; (F) promote or advertise any person, product or service or solicit funds; or (G) are deemed confidential by any contract or policy.

You are solely responsible for any Submissions you make and their accuracy. We take no responsibility and assume no liability for any Submissions posted by you or any third party.

Unless approved by us in writing in advance, you agree not to: (i) provide or create a link to the Site; or (ii) create any frames at any other sites pertaining to any of the content located on the Site.

We reserve the right, in our discretion, to update, change or replace any part of these Terms of Use for Posting Comments by posting updates and/or changes to our Site.  It is your responsibility to check this page periodically for changes.  Your continued use of, and/or access to the Site, following the posting of any changes to these Terms of Use for Posting Comments, constitutes your acceptance of those changes.