{"id":12194,"date":"2026-08-21T16:48:13","date_gmt":"2026-08-21T16:48:13","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12194"},"modified":"2026-08-21T16:48:13","modified_gmt":"2026-08-21T16:48:13","slug":"us-ties-hbos-6-million-bitcoin-ransom-attempt-to-iran","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12194","title":{"rendered":"US ties HBO\u2019s $6 million Bitcoin ransom attempt to Iran"},"content":{"rendered":"<p><\/p>\n<div data-single-article-content=\"\">\n<p>US prosecutors have expanded an eight-year-old hacking case tied to Iran\u2019s Islamic Revolutionary Guard Corps, adding eight defendants and linking six of them to the 2017 HBO breach that included a $6 million Bitcoin extortion attempt.<\/p>\n<p>A 14-count second superseding indictment unsealed Aug. 18 charges 17 people connected to Iran-based Mabna Institute, up from nine defendants named when the Justice Department first brought the case in 2018.<\/p>\n<p>Prosecutors allege Mabna operated as a private company that carried out cyber intrusions on behalf of the IRGC and other Iranian government, university and private-sector clients.<\/p>\n<p>Six of the newly added defendants, including Behzad Mesri, Saeid Houshyar, Manouchehr Hashemloo, Keyvan Fayaz, Saber Shahbazi Ballojeh and Arman Kahzadian, are accused of participating in the 2017 HBO intrusion.<\/p>\n<p>That breach led to an attempted Bitcoin extortion after hackers allegedly stole unreleased television episodes, scripts, and other proprietary material.<\/p>\n<p>Prosecutors said the demand began at $5.5 million and rose to roughly $6 million before stolen HBO content was leaked online.<\/p>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"aligncenter wp-image-556950\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f.png\" alt=\"US expands Iran-linked hacking case to 17 defendants over HBO\u2019s $6 million Bitcoin ransom plot\" width=\"720\" height=\"1131\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f.png 1001w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f-191x300.png 191w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f-652x1024.png 652w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f-768x1206.png 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f-978x1536.png 978w\" sizes=\"(max-width: 720px) 100vw, 720px\"\/><img decoding=\"async\" class=\"lazyload aligncenter wp-image-556950\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f.png\" alt=\"US expands Iran-linked hacking case to 17 defendants over HBO\u2019s $6 million Bitcoin ransom plot\" width=\"720\" height=\"1131\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f.png 1001w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f-191x300.png 191w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f-652x1024.png 652w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f-768x1206.png 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/08\/exec-375c508f-42f9-460b-bb46-24ef78fe401f-978x1536.png 978w\" data-sizes=\"(max-width: 720px) 100vw, 720px\"\/><\/p>\n<p>The Justice Department has not alleged that HBO paid the ransom.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining the Daily Brief\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Daily Brief <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">The signal, before the noise.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start your day with the crypto stories moving markets, decoded by CryptoSlate\u2019s editors.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p class=\"cs-inline-newsletter__form-heading\">One email. Everything that matters.<\/p>\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Free to join. Unsubscribe any time.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<p> <i class=\"fa-regular fa-circle-check\" aria-hidden=\"true\"\/> <span><strong>You\u2019re on the list.<\/strong> Your next Daily Brief is on its way.<\/span><\/p>\n<\/div>\n<\/div>\n<\/aside>\n<p>Mesri had previously been charged separately over the HBO attack in 2017. The new indictment brings that episode into the broader Mabna prosecution rather than alleging a fresh breach.<\/p>\n<h2>Wider campaign targeted universities and government victims<\/h2>\n<p>Meanwhile, the Mabna operation extended well beyond HBO.<\/p>\n<p>Prosecutors allege the group targeted more than 100,000 professor accounts and successfully compromised about 8,000, stealing at least 31.5 terabytes of academic data and intellectual property through activity that continued until at least December 2017.<\/p>\n<p>The government also alleges Galekuhi, Fayaz and Ballojeh participated in attacks against private-sector and government organizations that caused more than $20 million in investigation and remediation costs.<\/p>\n<p>Alongside the indictment, the State Department\u2019s Rewards for Justice program offered rewards of up to $10 million for information leading to the location of Mesri, Galekuhi, Kahzadian, Fayaz and Ballojeh.<\/p>\n<p>The superseding indictment marks the latest effort by US authorities to widen the case against an alleged Iranian cyber network first charged nearly a decade ago, while tying one of its most prominent alleged operations \u2014 the HBO hack \u2014 directly into the broader prosecution.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">US Treasury Department blacklists Bitcoin addresses linked to Iran ransomware group<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<\/div>\n<p>Crime,Featured,Hacks,Bitcoin,BTC,paymentsBitcoin,BTC,payments#ties #HBOs #million #Bitcoin #ransom #attempt #Iran1787330893<\/p>\n","protected":false},"excerpt":{"rendered":"<p>US prosecutors have expanded an eight-year-old hacking case tied to Iran\u2019s Islamic Revolutionary Guard Corps, adding eight defendants and linking six of them to the 2017 HBO breach that included a $6 million Bitcoin extortion attempt. A 14-count second superseding indictment unsealed Aug. 18 charges 17 people connected to Iran-based Mabna Institute, up from nine<\/p>\n","protected":false},"author":1,"featured_media":12195,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[6233,91,285,6416,2913,406,167,6417,2173],"class_list":["post-12194","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-attempt","tag-bitcoin","tag-btc","tag-hbos","tag-iran","tag-million","tag-payments","tag-ransom","tag-ties"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>US ties HBO\u2019s $6 million Bitcoin ransom attempt to Iran - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"US prosecutors expanded the Mabna Institute case to 17 defendants, tying six newcomers to the 2017 HBO breach.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=12194\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"US ties HBO\u2019s $6 million Bitcoin ransom attempt to Iran\" \/>\n<meta property=\"og:description\" content=\"US prosecutors expanded the Mabna Institute case to 17 defendants, tying six newcomers to the 2017 HBO breach.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=12194\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-21T16:48:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/iran-hacker-doj-case.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12194\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=12194\",\"name\":\"US ties HBO\u2019s $6 million Bitcoin ransom attempt to Iran - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12194#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12194#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/iran-hacker-doj-case.jpg\",\"datePublished\":\"2026-08-21T16:48:13+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"US prosecutors expanded the Mabna Institute case to 17 defendants, tying six newcomers to the 2017 HBO breach.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12194#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=12194\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12194#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/iran-hacker-doj-case.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/iran-hacker-doj-case.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12194#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"US ties HBO\u2019s $6 million Bitcoin ransom attempt to Iran\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"US ties HBO\u2019s $6 million Bitcoin ransom attempt to Iran - Crypto News: Latest Cryptocurrency News and Analysis","description":"US prosecutors expanded the Mabna Institute case to 17 defendants, tying six newcomers to the 2017 HBO breach.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=12194","og_locale":"en_US","og_type":"article","og_title":"US ties HBO\u2019s $6 million Bitcoin ransom attempt to Iran","og_description":"US prosecutors expanded the Mabna Institute case to 17 defendants, tying six newcomers to the 2017 HBO breach.","og_url":"https:\/\/cryptonews.uk.com\/?p=12194","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-08-21T16:48:13+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/iran-hacker-doj-case.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=12194","url":"https:\/\/cryptonews.uk.com\/?p=12194","name":"US ties HBO\u2019s $6 million Bitcoin ransom attempt to Iran - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=12194#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=12194#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/iran-hacker-doj-case.jpg","datePublished":"2026-08-21T16:48:13+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"US prosecutors expanded the Mabna Institute case to 17 defendants, tying six newcomers to the 2017 HBO breach.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=12194#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=12194"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=12194#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/iran-hacker-doj-case.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/iran-hacker-doj-case.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=12194#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"US ties HBO\u2019s $6 million Bitcoin ransom attempt to Iran"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12194"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12194\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/12195"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}