Since at least 2013, 17 alleged operatives from the Mabna Institute “carried out intrusions at 144 US-based universities, 178 foreign universities, at least 42 US-based private sector companies, 11 foreign private sector companies, five US federal and state government agencies, and at least two non-governmental organizations,” the Department of Justice said.
Operation Economic Outcast: a financial squeeze announced on August 24
On August 24, treasury secretary, Scott Bessent, announced Operation Economic Outcast — a new round of sanctions directed at nearly 60 individuals and entities intended to “cut the financial flows sustaining Tehran,” according to the Treasury. The package targets both specific actors and entire sectors of the Iranian economy.
The designations were published by the Treasury’s Office of Foreign Assets Control (OFAC) and include measures aimed at digital assets, technology, gold, aviation and shipping, broadening the categories of Iran-related conduct that may draw secondary sanctions.
Mabna Institute defendants: indictments and targeted sanctions
Five individuals tied to the Mabna Institute were singled out in the latest sanctions, and they were among 17 people indicted by the Department of Justice on August 18 for participation in alleged cyber-espionage campaigns. The DOJ indictment characterizes a long-running campaign of intrusions across academic, private-sector, government and non-governmental targets.
OFAC’s list also included 30 cryptocurrency addresses across Bitcoin, Ethereum and TRON that it attributed to four of the 17 defendants.
Your town's IT department is one person. Maybe.
Ransomware crews target small municipalities because nobody's watching. Nubivance gives Maine and New Hampshire towns a security program sized to a town budget.
Protect the town officeBlockchain traces: TRM Labs’ mapping of roughly $16.8m
Blockchain forensics firm TRM Labs published a blog post on August 24 describing the cryptocurrency linkages included in OFAC’s designations. TRM Labs said the listed addresses contain about $16.8m in funds dating back to 2018.
- About $15.5m sits in 10 addresses TRM Labs associates with Keyvan Fayaz (aka Achilles, The Joker, and bc.monster). TRM Labs observed that pattern and suggested “he may have acted as a treasury of sorts for Mabna's hacking-for-hire operations.”
- Roughly $1.2m was associated with 15 addresses linked to Behzad Mesri. TRM Labs described those Mesri-linked addresses as showing “a pattern of layered transactions between his addresses, with hundreds of thousands ultimately funnelled to a deposit address at a large centralized exchange, likely to be cashed out – on-chain behavior commonly used to obfuscate source of funds.”
Sectoral reach: digital assets, technology, gold, aviation and shipping
Operation Economic Outcast extends beyond individual sanctions. The designations allow OFAC to sanction any person or entity providing services in support of the five named sectors. TRM Labs warned that “these determinations expand the categories of Iran-related conduct that may be subject to secondary sanctions, and they allow OFAC to sanction any person or entity providing services in support of five sectors of the Iranian economy.”
TRM Labs emphasized a direct operational consequence: “Under the new sectoral determination, any institution that processes a significant transaction for an Iranian exchange or digital assets business in turn risks its access to the US financial system.”
What this means for cryptocurrency compliance teams, universities, and exchanges
Cryptocurrency compliance teams: The OFAC designations and TRM Labs’ on-chain mappings make clear that compliance programs will need to screen transactions for wallets with exposure to the named Mabna addresses and other Iran-linked entities. TRM Labs advised that teams “screen out transactions from Iranian entities, to avoid being punished by the US government” and to flag incoming transactions from wallets exposed to Mabna Institute wallets.
Universities and private-sector organizations named by the DOJ: The DOJ’s tally of affected organizations—144 US-based universities and dozens of private-sector companies among other victims—highlights the scale of alleged intrusions in the indictment and the potential institutional risk tied to illicit cyber operations and their proceeds.
Exchanges and custodians: TRM Labs’ description of funds moving toward a “deposit address at a large centralized exchange, likely to be cashed out” signals that exchanges and custodial platforms will face focused compliance scrutiny where on-chain flows intersect with centralized fiat on-ramps.
Taken together, the Treasury’s sectoral determinations and the DOJ’s indictments tie criminal allegations, forensic crypto-tracing and broad economic tools into a single campaign. For now, the public record supplied by OFAC, the Department of Justice and TRM Labs leaves a clear operational order: identify exposed wallets, screen transactions tied to the named sectors, and be alert for layered movement that may be intended to obfuscate proceeds. How aggressively enforcement will cascade through secondary sanctions and into global financial and crypto infrastructure remains the next practical test of Operation Economic Outcast.
Source: https://www.infosecurity-magazine.com/news/us-sanctions-mabna-institute/
