IRANIAN NATIONAL ACCUSED IN MASSIVE UNIVERSITY HACKING CAMPAIGN EXTRADITED TO UNITED STATES

An Iranian and Turkish national accused by U.S. prosecutors of participating in a large-scale cyber campaign targeting universities, companies and government institutions has been extradited from Montenegro to the United States.

Amir Barati, 40, was extradited following a final decision by the Higher Court in Podgorica authorizing his transfer to U.S. authorities.

Montenegrin police said Barati had been considered a high-profile cybercrime and organized-crime target before his arrest.

He was taken into custody on June 25, 2026, in the municipality of Kotor after Montenegro’s NCB Interpol Podgorica and local police acted on a direct arrest request issued by U.S. authorities and the FBI.

Barati is one of 17 people charged in a 14-count superseding federal indictment involving the Mabna Institute, an Iran-based organization accused of carrying out coordinated cyber intrusions against universities, private companies, government agencies and other organizations.

According to the Justice Department, the Mabna Institute operated from at least 2013 and carried out hacking activities for Iranian government and private entities. Prosecutors allege that the university spearphishing campaign was conducted on behalf of Iran’s Islamic Revolutionary Guard Corps.

The indictment alleges that the group targeted more than 100,000 professor accounts around the world and successfully compromised approximately 8,000 university email accounts.

The campaign affected 144 U.S.-based universities and 178 universities in foreign countries.

Federal prosecutors also allege that the defendants targeted at least 42 U.S. private-sector companies, at least 11 foreign companies, at least five U.S. federal and state government agencies and at least two nongovernmental organizations.

Authorities said the operation resulted in the theft of at least approximately 31.5 terabytes of academic data and intellectual property.

The stolen material allegedly included academic journals, theses, dissertations, electronic books, research documents, proprietary information and other materials obtained through compromised accounts and institutional systems.

Barati is specifically accused of helping coordinate and support the intrusion campaign.

According to federal prosecutors, he allegedly tracked the progress of spearphishing operations, exchanged login credentials for compromised accounts, created targeting lists, conducted computer-network reconnaissance and helped prepare phishing messages used to obtain access to victim systems.

The conspiracy allegedly relied heavily on credential theft.

Victims were targeted with deceptive messages designed to capture usernames and passwords. Once credentials were obtained, the accounts could be used to gain unauthorized access to university systems and academic resources.

Prosecutors allege that material obtained through the hacking operation was provided to Iranian government interests and was also commercialized through services that sold access to stolen academic resources.

One part of the alleged operation allowed customers in Iran to use compromised professor credentials to access online library systems belonging to foreign universities.

The Justice Department has stated that U.S. universities spent more than $3.4 billion to purchase and access the types of academic data and intellectual property targeted by the conspiracy. Separate intrusion activity attributed to Mabna Institute members caused victims to incur more than $20 million in investigation and remediation costs.

Montenegrin authorities said Barati was sought by the United States in connection with offenses they described as causing approximately $3.4 billion in damage.

That characterization differs from the Justice Department’s statement that U.S. universities spent more than $3.4 billion to procure and access the types of academic data and intellectual property targeted by the conspiracy.

The August superseding indictment expanded a long-running federal prosecution involving the Mabna Institute. The original 2018 case named nine Iranian defendants — Gholamreza Rafatnejad, Ehsan Mohammadi, Seyed Ali Mirkarimi, Abdollah Karima, Mostafa Sadeghi, Sajjad Tahmasebi, Mohammed Reza Sabahi, Roozbeh Sabahi and Abuzar Gohari Moqadam.

The FBI placed those defendants on its wanted list in connection with the university-focused cyber intrusion campaign. The 2026 superseding indictment added eight more defendants and expanded the alleged scope of the operation.

Barati faces multiple federal charges, including conspiracy to commit computer intrusions, conspiracy to commit wire fraud, computer fraud, wire fraud and aggravated identity theft.

The charges remain allegations. Barati is presumed innocent unless and until proven guilty beyond a reasonable doubt in a court of law.

His extradition places one of the defendants physically within reach of the U.S. federal court system after years of allegations involving cyber operations conducted from outside the United States.

The case also reflects the international dimension of major cybercrime investigations. The FBI’s pursuit of Barati ultimately required cooperation between U.S. authorities, Montenegro’s police, Interpol personnel and the Montenegrin court system before extradition could occur.

The broader Mabna Institute prosecution remains active, with multiple defendants still accused of participating in cyber operations targeting academic institutions, private-sector organizations and government entities across several countries.

---

---

---

---

U.S. Department of Justice — United States v. Rafatnejad et al., Second Superseding Indictment, U.S. District Court for the Southern District of New York. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---