Biographical details:

• Fayyaz is Iranian and lives in Iran.
• He is known by the following online aliases: Keyvan Karimi, Hurr!c4nE!, k3yv4n, b.cmonster, fokonishi, Achilles, Chikoo, JakJak, the.joker. hensi, Team XXXX.

Summary of activities within Iranian Cyber Operations:
Fayyaz has been linked with the Mabna Institute that is known to be strongly linked to the Iranian Ministry of Intelligence and Security (MOIS). He has also been linked to the Ajax Security Team and the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC IO).

Key Incidents and Attribution:
The FBI has stated that Fayyaz was recruited to join the IRGC IO Department 2000, where he conducted malicious cyber operations against the U.S and foreign defense organizations and various Israeli targets across several sectors.
Following employment with the IRGC IO, Fayyaz worked for the Mabna Institute, which was founded by two U.S-indicted MOIS cyber officers. The Mabna Institute conducted a massive spear phishing and intellectual property campaign targeting U.S and other professors and universities worldwide on behalf of the IRGC.
As a Mabna Institute employee, Fayyaz was involved in the hack and extortion of the U.S entertainment company HBO at the behest of the IRGC and participated in hacking operations targeting several U.S defense companies, a U.S communications technology provider, a Saudi energy company, and others.

International Recognition & Legal Actions

US Criminal Indictments and Arrest Warrants:
In 2020, U.S authorities indicted Fayyaz for his malicious activities conducted while working for the Mabna Institute.
On the 18 August 2026, the U.S Department of Justice “Rewards for Justice” program announced that it is offering a reward of up to $10 million for information leading to the identification or location of any person who, while acing at the direction or under the control of a foreign government, participates in malicious cyber activities against U.S critical infrastructure in violation of the Computer Fraud and Abuse Act.

The U.S Department of Justice unveiled the 14-count superseding (S2) indictment charging 17 members of the Mabna Institute, including Fayyaz. The superseding indictment alleged that, at the behest of entities including the IRGC, these defendants hacked into universities and other research institutions worldwide, including the United States, stealing at least 31 terabytes of information and intellectual property of untold value.

Sanctions and Designations: The U.S Treasury released a press release on the 24 August 2026 announcing a fresh wave of sanctions against more than 60 officials, entities, and networks linked to Iran’s military, cyber, and oil trading activities. These sanctions included Fayyaz and other members of the Mabna Institute.