Iranian hacker Amir Barati extradited from Montenegro
Montenegro has extradited an Iranian national whom US prosecutors accuse of playing a central role in a long-running campaign that stole academic research and intellectual property from universities around the world.
Amir Barati, 40, holds both Iranian and Turkish citizenship. Montenegro's Police Directorate, the country's national police authority, arrested him on June 25 after the FBI issued a warrant. He was detained while on vacation in Kotor, a coastal municipality. A Montenegrin court made the final decision to hand him over to the US this week.
A 14-count indictment against 17 people
In August, the US Justice Department named Barati in a 14-count indictment that charges 17 people. Prosecutors say the operation was run through an Iranian company called the Mabna Institute, acting for the Islamic Revolutionary Guard Corps (IRGC), a branch of Iran's armed forces.
Barati faces multiple counts of conspiracy to commit computer intrusions, wire fraud, computer fraud and identity theft.
According to prosecutors, Barati "was involved in tracking the progress of the spearphishing campaigns, exchanging login credentials for compromised accounts with other co-conspirators, creating targeting lists, conducting computer network reconnaissance, and crafting phishing messages."
Professors' inboxes as the entry point
The campaign focused on email accounts at universities and other research institutions. Between 2013 and 2017, the group allegedly broke into about 8,000 email accounts belonging to professors, then used the stolen credentials to get further access.
The DOJ says the victims included:
- 144 American universities
- 42 US companies
- 178 foreign universities
- at least 11 foreign companies
At least 31 terabytes of data were taken. The haul reportedly included academic journals, theses, dissertations and electronic books spanning dozens of fields. US officials put the total damage linked to Barati's group at $3.4 billion. The affected universities spent roughly $20 million investigating and cleaning up after the breaches, prosecutors said.
Stolen research sold back home
The DOJ says the stolen documents went to the Iranian government. They were also sold to universities in Iran through two websites. One of those sites let customers in Iran use compromised professor accounts to log into the online library systems of several US universities.
This detail stands out. The access itself became a product, not just the files taken from it.
A long history in Iran's hacking scene
Iran International reported that Barati has a lengthy background as a hacker in Iran. The outlet says he founded several well-known groups, including the Iran Black Hats Team and the Digital Boys Underground Team. These groups were accused of attacks on Microsoft, MIT and other institutions.
According to the same report, Iran's Intelligence Ministry arrested Barati in 2010 and forced him to work for it for several years. After leaving Iran, he changed his name in 2021 and became a Turkish citizen.
Our Take
Cases against state-backed hackers rarely end with a defendant in a US courtroom. Most indictments of this kind stay symbolic because the accused never leave their home countries. Barati's arrest shows the main way that changes: travel. A holiday in a country willing to act on an FBI warrant was enough. It's a reminder that law enforcement pressure on cyber actors, seen recently in efforts such as the FBI's push against ShinyHunters members, increasingly depends on cross-border cooperation.
For universities and research bodies, the technique matters more than the arrest. The alleged campaign did not rely on exotic exploits. It relied on phishing and reused credentials, much like the state-backed phishing aimed at Ukraine's supporters and the recent campaigns targeting AI experts. Academic accounts remain attractive because they open doors to paid research libraries and unpublished work.
It is worth watching whether the US case reveals more about how the Mabna Institute operated, and whether other named defendants are tracked down in a similar way.