Iranian Hackers Charged in $6 Million Bitcoin Extortion Scheme: How State-Sponsored Ransomware Works

Seventeen Iranian operatives were charged Thursday in a $6 million bitcoin extortion campaign that hit 320 universities across 22 countries, the Justice Department announced. The indictment alleges the Mabna Institute, an Iran-based contractor for the Islamic Revolutionary Guard Corps, spent years infiltrating academic and corporate networks to steal research and credentials, then demanded bitcoin payments to restore access or prevent data leaks. CoinGecko data shows Bitcoin traded at $72,627 on the day of the announcement, up 6% in 24 hours and 14.7% over the prior week.

How the extortion mechanism worked

The Mabna Institute ran what prosecutors describe as a password-spraying operation: automated scripts tested common passwords across thousands of university email accounts until one succeeded. Once inside, actors moved laterally through library systems, research databases, and VPN portals. Stolen credentials were cataloged and sold on underground markets; proprietary research was held for ransom. Victims received demands payable in bitcoin to wallet addresses prosecutors say were controlled by the defendants. The cryptocurrency's pseudonymous design, transactions recorded on a public ledger but addresses not directly tied to identities, made it the preferred rail. Investigators traced on-chain flows from victim wallets through mixing services and into exchange deposit addresses, where know-your-customer records provided the link to real-world entities.

Who is affected and how

Universities lost 31 terabytes of intellectual property, pharmaceutical research, engineering designs, climate models. Companies in biotech, defense, and energy sectors saw proprietary data exfiltrated. Government agencies in the U.S., U.K., and Australia had credential databases compromised. The bitcoin ransoms ranged from a few thousand dollars for individual faculty accounts to six-figure sums for institutional database access. per CoinGecko, at current prices, the $6 million total represents roughly 82.6 BTC. Victims who paid received decryption keys in some cases; others faced continued leaks.

Why this is happening now

The indictment arrives as ransomware gangs increasingly adopt nation-state tradecraft, and nation-states adopt ransomware revenue models. Iran's economy, constrained by sanctions, has turned to cybercrime as a hard-currency stream. North Korea's Lazarus Group pioneered the model; Mabna appears to have industrialized it for academic targets. Bitcoin's liquidity and global reach make it the settlement layer. Figures from the desk show the 14.7% weekly price gain means ransoms demanded in dollar terms translate to fewer bitcoin, but victims still pay because the alternative is permanent data loss.

What to watch next

Prosecutors have seized several wallet addresses and are pursuing forfeiture of traceable bitcoin. The Treasury Department's Office of Foreign Assets Control will likely designate the Mabna Institute and associated addresses, triggering compliance obligations for U.S. exchanges. Watch for: The case establishes that bitcoin extortion by state contractors is now a prosecutable offense with named defendants, not just an anonymous threat. That precedent may deter future campaigns, or push them toward privacy coins.