{ "id": "0984df61-7ca8-4847-9c03-a3207709d5ad", "created_at": "2026-04-06T15:53:51.013353Z", "updated_at": "2026-04-10T03:20:27.004198Z", "deleted_at": null, "sha1_hash": "9d052d6db0212ed07ca6242cedc6dfa798ae3fb3", "title": "Former U.S. Counterintelligence Agent Charged With Espionage on Behalf of Iran; Four Iranians Charged With a Cyber Campaign Targeting Her Former Colleagues", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 43387, "plain_text": "Former U.S. Counterintelligence Agent Charged With Espionage\r\non Behalf of Iran; Four Iranians Charged With a Cyber Campaign\r\nTargeting Her Former Colleagues\r\nPublished: 2019-02-13 · Archived: 2026-04-06 15:12:52 UTC\r\nMonica Elfriede Witt, 39, a former U.S. service member and counterintelligence agent, has been indicted by a\r\nfederal grand jury in the District of Columbia for conspiracy to deliver and delivering national defense\r\ninformation to representatives of the Iranian government.  Witt, who defected to Iran in 2013, is alleged to have\r\nassisted Iranian intelligence services in targeting her former fellow agents in the U.S. Intelligence Community\r\n(USIC).  Witt is also alleged to have disclosed the code name and classified mission of a U.S. Department of\r\nDefense Special Access Program. An arrest warrant has been issued for Witt, who remains at large.\r\nThe same indictment charges four Iranian nationals, Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar and\r\nMohamad Paryar (the “Cyber Conspirators”), with conspiracy, attempts to commit computer intrusion and\r\naggravated identity theft, for conduct in 2014 and 2015 targeting former co-workers and colleagues of Witt in the\r\nU.S. Intelligence Community.  The Cyber Conspirators, using fictional and imposter social media accounts and\r\nworking on behalf of the Iranian Revolutionary Guard Corps (IRGC), sought to deploy malware that would\r\nprovide them covert access to the targets’ computers and networks.  Arrest warrants have been issued for the\r\nCyber Conspirators, who also remain at large.\r\nThe announcement was made by Assistant Attorney General for National Security John Demers, U.S. Attorney\r\nJessie K. Liu for the District of Columbia, Executive Assistant Director for National Security Jay Tabb of the FBI,\r\nU.S. Treasury Secretary Steven Mnuchin, Special Agent Terry Phillips of the Air Force Office of Special\r\nInvestigations, and Assistant Director in Charge Nancy McNamara of the FBI’s Washington Field Office.\r\n“Monica Witt is charged with revealing to the Iranian regime a highly classified intelligence program and the\r\nidentity of a U.S. Intelligence Officer, all in violation of the law, her solemn oath to protect and defend our\r\ncountry, and the bounds of human decency,” said Assistant Attorney General Demers.  “Four Iranian cyber\r\nhackers are also charged with various computer crimes targeting members of the U.S. intelligence community who\r\nwere Ms. Witt’s former colleagues. This case underscores the dangers to our intelligence professionals and the\r\nlengths our adversaries will go to identify them, expose them, target them, and, in a few rare cases, ultimately turn\r\nthem against the nation they swore to protect.  When our intelligence professionals are targeted or betrayed, the\r\nNational Security Division will relentlessly pursue justice against the wrong-doers.” \r\n“This case reflects our firm resolve to hold accountable any individual who betrays the public trust by\r\ncompromising our national security,” said U.S. Attorney Liu.  “Today’s announcement also highlights our\r\ncommitment to vigorously pursue those who threaten U.S. security through state-sponsored hacking campaigns.”\r\n“The charges unsealed today are the result of years of investigative work by the FBI to uncover Monica Witt’s\r\nbetrayal of the oath she swore to safeguard America’s intelligence and defense secrets” said Executive Assistant\r\nDirector for National Security Tabb.  “This case also highlights the FBI’s commitment to disrupting those who\r\nhttps://www.justice.gov/opa/pr/former-us-counterintelligence-agent-charged-espionage-behalf-iran-four-iranians-charged-cyber\r\nPage 1 of 3\n\nengage in malicious cyber activity to undermine our country’s national security. The FBI is grateful to the\r\nDepartment of Treasury and the United States Air Force for their continued partnership and assistance in this\r\ncase.”\r\n“Treasury is taking action\r\nagainst malicious Iranian cyber actors and covert operations that have targeted Americans at home and overseas as\r\npart of our ongoing efforts to counter the Iranian regime’s cyber-attacks,” said Treasury Secretary Steven\r\nMnuchin.  “Treasury is sanctioning New Horizon Organization for its support to the IRGC-QF.  New Horizon\r\nhosts international conferences that have provided Iranian intelligence officers a platform to recruit and collect\r\ndamaging information from attendees, while propagating anti-Semitism and Holocaust denial.  We are also\r\nsanctioning an Iran-based company that has attempted to install malware to compromise the computers of U.S.\r\npersonnel.”\r\n“The alleged actions of Monica Witt in assisting a hostile nation are a betrayal of our nation’s security, our\r\nmilitary, and the American people,” said Special Agent Phillips. “While violations like this are extremely rare, her\r\nactions as alleged are an affront to all who have served our great nation.”  \r\n“This investigation exemplifies the tireless work the agents and analysts of the FBI do each and every day to bring\r\na complex case like this to fruition,’ said Assistant Director in Charge McNamara.  “Witt's betrayal of her country\r\nand the actions of the cyber criminals - at the behest of the IRGC - could have brought serious damage to the\r\nUnited States, and we will not stand by and allow that to happen.  The efforts by the Iranian government to target\r\nand harm the U.S. will not be taken lightly, and the FBI will continue our work to hold those individuals or groups\r\naccountable for their actions.”\r\nAccording to the allegations contained in the indictment unsealed today:\r\nMonica Witt’s Espionage\r\nMonica Witt, a U.S. citizen, was an active duty U.S. Air Force Intelligence Specialist and Special Agent of the Air\r\nForce Office of Special Investigations, who entered on duty in 1997 and left the U.S. government in 2008. \r\nhttps://www.justice.gov/opa/pr/former-us-counterintelligence-agent-charged-espionage-behalf-iran-four-iranians-charged-cyber\r\nPage 2 of 3\n\nMonica Witt separated from the Air Force in 2008 and ended work with DOD as a contractor in 2010.  During her\r\ntenure with the U.S. government, Witt was granted high-level security clearances and was deployed overseas to\r\nconduct classified counterintelligence missions.\r\nIn Feb. 2012, Witt traveled to Iran to attend the Iranian New Horizon Organization’s “Hollywoodism” conference,\r\nan IRGC-sponsored event aimed at, among other things, condemning American moral standards and promoting\r\nanti-U.S. propaganda.  Through subsequent interactions and communications with a dual United States-Iranian\r\ncitizen referred to in the indictment as Individual A, Witt successfully arranged to re-enter Iran in Aug. 2013. \r\nThereafter, Iranian government officials provided Witt with a housing and computer equipment.  She went on to\r\ndisclose U.S. classified information to the Iranian government official.  As part of her work on behalf of the\r\nIranian government, she conducted research about USIC personnel that she had known and worked with, and used\r\nthat information to draft “target packages” against these U.S. agents.   \r\nIranian Hacking Efforts Targeting Witt’s Former Colleagues\r\nBeginning in late 2014, the Cyber Conspirators began a malicious campaign targeting Witt’s former co-workers\r\nand colleagues.  Specifically, Mesri registered and helped manage an Iranian company, the identity of which is\r\nknown to the United States, which conducted computer intrusions against targets inside and outside the United\r\nStates on behalf of the IRGC.  Using computer and online infrastructure, in some cases procured by Mesri, the\r\nconspiracy tested its malware and gathered information from target computers or networks, and sent spearphishing\r\nmessages to its targets.  Specifically, between Jan. and May 2015, the Cyber Conspirators, using fictitious and\r\nimposter accounts, attempted to trick their targets into clicking links or opening files that would allow the\r\nconspirators to deploy malware on the target’s computer.  In one such instance, the Cyber Conspirators created a\r\nFacebook account that purported to belong to a USIC employee and former colleague of Witt, and which utilized\r\nlegitimate information and photos from the USIC employee’s actual Facebook account. This particular fake\r\naccount caused several of Witt’s former colleagues to accept “friend” requests.\r\n*          *          *\r\nThe case is being investigated by the FBI’s Washington Field Office with assistance from the Air Force Office of\r\nSpecial Investigations.  The prosecution is being handled by Assistant U.S. Attorneys Deborah Curtis, Jocelyn\r\nBallantine and Luke Jones of the U.S. Attorney’s Office for the District of Columbia with assistance from Trial\r\nAttorney Evan N. Turgeon of the National Security Division’s Counterintelligence and Export Control Section.\r\nSource: https://www.justice.gov/opa/pr/former-us-counterintelligence-agent-charged-espionage-behalf-iran-four-iranians-charged-cyber\r\nhttps://www.justice.gov/opa/pr/former-us-counterintelligence-agent-charged-espionage-behalf-iran-four-iranians-charged-cyber\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "MISPGALAXY", "ETDA" ], "references": [ "https://www.justice.gov/opa/pr/former-us-counterintelligence-agent-charged-espionage-behalf-iran-four-iranians-charged-cyber" ], "report_names": [ "former-us-counterintelligence-agent-charged-espionage-behalf-iran-four-iranians-charged-cyber" ], "threat_actors": [], "ts_created_at": 1775490831, "ts_updated_at": 1775791227, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/9d052d6db0212ed07ca6242cedc6dfa798ae3fb3.pdf", "text": "https://archive.orkl.eu/9d052d6db0212ed07ca6242cedc6dfa798ae3fb3.txt", "img": "https://archive.orkl.eu/9d052d6db0212ed07ca6242cedc6dfa798ae3fb3.jpg" } }