The US Treasury has designated nearly 60 Iran-linked entities, individuals and vessels under Operation Economic Outcast, which it describes as an unprecedented, whole-of-government economic campaign spanning nuclear, missile, oil and cyber networks.

Six of those designations are people, and they matter more than the number.

The six

Behzad Mesri, Mojtaba Ghal'eh-Kuhi, Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, Mohammad Reza Kadkhoda'i and Arman Kahzadian — all affiliated with Tehran's Mabna Institute.

Treasury says the group frequently conducts computer network exploitations on behalf of Iran's Ministry of Intelligence and Security, and alleges:

  • Extensive compromises of US critical infrastructure
  • Data exfiltration from energy, defence, healthcare, IT and financial companies since late 2023
  • Breaches of government offices across multiple US states in summer 2024
  • Cryptocurrency theft, with one individual said to control over $30,000 in Bitcoin

The State Department's Rewards for Justice programme is offering up to $10 million for information on people conducting malicious cyber activity against US critical infrastructure at the direction of a foreign government.

They have been here before

The Mabna Institute is not a new name. It was founded in Tehran around 2013 and was sanctioned by this same Treasury in 2018, alongside a Justice Department indictment.

The 2018 case alleged theft of more than 31 terabytes of academic data from 144 US universities and 176 universities in other countries — over 300 institutions across 21 countries — with the stolen research sold through commercial websites in Tehran.

Behzad Mesri, named again this week, was separately charged over the HBO breach, in which proprietary material was stolen and roughly $6 million in Bitcoin was demanded.

Sanctioned in 2018. Sanctioned again in 2026. That is the honest measure of what the first round achieved against this particular group, and it is worth setting against the argument that regulators have finally found penalty levels that change behaviour. Sanctions on people who do not travel to, hold assets in, or transact with the sanctioning country are a different instrument with different limits.

One discrepancy worth noting

The 2018 case described the Mabna Institute as operating under contract to the Islamic Revolutionary Guard Corps. This week's Treasury language puts the group's work on behalf of the Ministry of Intelligence and Security.

Those are different Iranian services. There are ordinary explanations — assessments are updated, and contractors can work for more than one customer — but it is a change in the official account of who directs them, and it has passed without comment.

What this does not establish

Here is the part that will be got wrong everywhere this week.

Last week a small British power plant was stopped for four days, and the coverage called it Iran-linked. The UK government has since confirmed the incident and said there was at no point a risk to the wider energy system — while attributing it to nobody, and still not naming the plant.

These sanctions concern US critical infrastructure. The designations do not name the UK attack, and Treasury has not connected the two.

Two Iran-related stories landing in the same fortnight is not evidence that they are the same story. The proximity is a property of the news cycle, not of the intelligence — and the chief executive of Dragos was on record last week warning that people jumping to conclusions on Iran being behind the UK attack are very susceptible to false flag operations.

Nothing published since changes that.

Why the designations still matter

Because they are specific in a way attribution rarely is. Six named people, a named institute, named sectors, and a stated period beginning in late 2023 — a level of detail a government does not publish without an evidentiary basis it is prepared to defend.

They are also a signal to the private sector about where to look: energy, defence, healthcare, IT and finance, from late 2023 onwards, is a hunting window, not a headline.

What is not established

  • Whether any of the six will face trial. Designation is not prosecution.
  • Which specific intrusions are attributed to which individuals.
  • Whether the group is responsible for the UK attack. Not claimed by anyone official.
  • Why the directing service is now described as MOIS rather than the IRGC.
  • What effect the 2018 sanctions had, which is the question the second round implicitly answers.