An Iranian national wanted by U.S. prosecutors for his alleged role in a years-long hacking campaign against universities and research institutions has been extradited from Montenegro to the United States.

Amir Barati, a 40-year-old dual citizen of Turkey and Iran, was arrested on June 25 by Montenegro’s Police Directorate after the FBI issued an arrest warrant. He was detained in the coastal town of Kotor while on vacation, and a Montenegrin court issued a final extradition decision this week.

Barati was named in a 14-count indictment unsealed by the Justice Department in August, which charged 17 people in connection with a sprawling operation prosecutors say was conducted through the Iranian company Mabna Institute on behalf of the Islamic Revolutionary Guard Corps.

Alleged Role in the Campaign

Prosecutors allege Barati helped track the progress of spearphishing campaigns, exchanged login credentials for compromised accounts with co-conspirators, built targeting lists, conducted network reconnaissance, and crafted phishing messages.

According to the DOJ, the hacking group breached 144 American universities and 42 U.S. companies, along with 178 foreign universities and at least 11 foreign companies. Between 2013 and 2017, the campaign allegedly compromised roughly 8,000 professor email accounts, using stolen credentials to access and exfiltrate academic journals, theses, dissertations, and electronic books spanning dozens of fields.

Investigators say the group stole at least 31 terabytes of data and intellectual property, which was handed over to the Iranian government and sold through two websites, one of which let customers in Iran use stolen professor credentials to access U.S. university library systems. U.S. officials put total damages at $3.4 billion, with affected universities spending about $20 million on investigation and remediation.

Barati faces multiple counts of conspiracy to commit computer intrusions, wire fraud, computer fraud, and identity theft.

Background

According to Iran International, Barati has a long history in Iran’s hacking scene, having founded groups such as the Iran Black Hats Team and Digital Boys Underground Team, both previously linked to attacks on Microsoft, MIT, and other institutions. The outlet reported that Iran’s Intelligence Ministry arrested him in 2010 and coerced him into working for the ministry for several years. He later became a Turkish citizen after changing his name in 2021.