Extradition of Iranian National Concludes Months-Long Legal Process
Amir Barati, a 40-year-old citizen of both Turkey and Iran, was extradited from Montenegro to the United States this week following a final court decision in the coastal municipality of Kotor. Barati had been arrested by Montenegro’s Police Directorate on June 25 after the FBI issued an international arrest warrant. His extradition marks the conclusion of a legal process that began when the U.S. Department of Justice unveiled a 14-count indictment in August, charging him and 16 others in connection with a expansive cyber espionage campaign.
Alleged Role in IRGC-Backed Hacking Operation Targeting Academia
Prosecutors allege Barati was a key figure in a hacking operation conducted through the Mabna Institute, an Iranian company believed to be operating on behalf of the Islamic Revolutionary Guard Corps (IRGC). The campaign, which spanned from 2013 to 2017, involved the unauthorized access to email accounts of approximately 8,000 professors at universities and research institutions worldwide. Using stolen credentials, the hackers breached systems to exfiltrate vast quantities of academic content.
The stolen data included academic journals, theses, dissertations, and electronic books across dozens of disciplines. According to the indictment, the group successfully compromised 144 American universities and 42 U.S. companies, as well as 178 foreign universities and at least 11 foreign companies. The total volume of stolen information was estimated at no less than 31 terabytes.
Financial Impact and Operational Details of the Cyber Campaign
U.S. officials have stated that the damages resulting from this intrusion campaign amounted to $3.4 billion, reflecting the value of the stolen intellectual property and the costs associated with breach response. The DOJ further reported that affected institutions collectively spent approximately $20 million to investigate and remediate the security incidents.
Barati’s alleged responsibilities within the conspiracy included monitoring the progress of spearphishing campaigns, exchanging login credentials for compromised accounts with co-conspirators, creating targeting lists, conducting computer network reconnaissance, and crafting deceptive phishing messages designed to harvest university login information.
Monetization of Stolen Academic Data Through Iranian Platforms
The Department of Justice asserted that the stolen documents were transferred to the Iranian government and subsequently made available through two websites operating within Iran. One platform allowed users in Iran to leverage the compromised professor credentials to access the online library systems of multiple U.S. universities, effectively enabling unauthorized access to subscription-based academic resources.
Legal Charges and Prior Hacking History
Barati faces multiple federal charges, including conspiracy to commit computer intrusions, wire fraud, computer fraud, and identity theft. These charges stem from his alleged participation in a sustained effort to compromise academic and corporate networks for the benefit of Iranian state interests.
Prior to his involvement in the Mabna Institute-linked campaign, Barati reportedly had a notable history in Iran’s hacking community. According to Iran International, he founded prominent hacking groups such as the Iran Black Hats Team and the Digital Boys Underground Team, which were accused of conducting cyberattacks against major targets including MIT and Microsoft. He was allegedly arrested by Iran’s Intelligence Ministry in 2010 and compelled to work for the state for several years before leaving Iran, obtaining Turkish citizenship, and changing his name in 2021.
Source: The Record