USC, Clemson dodge bullet in massive, Iranian hacking conspiracy

South Carolina's two major universities say they were not affected by a far-reaching Iranian hacking campaign that targeted roughly 50,000 American university professors since 2013.

“Clemson, like a large number of research universities across the country, was notified by the Department of Justice that our network users were subjected to phishing attacks," spokesman Mark Land said in an emailed statement. "After a thorough review by the university’s information technology organization, we found no evidence that those attacks resulted in any improper access of Clemson’s network resources.”

University of South Carolina also was unaffected by the hacking scheme, spokesman Jeff Stensland said in an email.

The alleged hacking campaign, coordinated by nine Iranian citizens, sought to steal research primarily from American universities, but also breached computers at several law enforcement agencies, private sector companies and nongovernmental organizations, according to a federal indictment filed Friday.

In a statement, the U.S. attorney for southern New York, Geoffrey Berman, called it "one of the largest state-sponsored hacking campaigns ever prosecuted by the Department of Justice."

The stolen information was worth roughly $3.4 billion, the indictment alleges.

Though the nine Iranians accused of coordinating the cyberattack worked for the Mabna Institute, an Iranian government contractor, the indictment holds responsible the Iranian government. "The defendants conducted this activity at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps, which is one of several entities within the government of Iran responsible for gathering intelligence," the indictment said.

If the nine Iranians are arrested, tried and convicted, they each could face a maximum of 77 years in prison on the charges, which include wire fraud and aggravated identity theft.

The hacking campaign didn't target just America. An additional 50,000 professors at 170 universities in 21 other countries also were targeted, according to the indictment. Around 8,000 professors worldwide were successfully hacked.

That's only 8 percent of those targeted, but the hackers allegedly were able to steal 31 terabytes of data, which is enough data to fill 121 high-capacity iPhone Xs.

The hackers allegedly carried out the hacking using a tactic known as "spearphishing." Hackers allegedly researched professors by looking at their online profiles, research interests and published articles. They then sent professors "customized" emails that tricked them into clicking on a link that would take them to a malicious website designed to look exactly like their university's website. The professors would then enter their login name and password, thus handing them over to hackers, the indictment said.

This story was originally published March 26, 2018 at 11:16 AM with the headline "USC, Clemson dodge bullet in massive, Iranian hacking conspiracy."