Iranian Hacker Extradited to U.S. Over $3.4B Cyberattack
A 40-year-old Iranian-Turkish dual national has been extradited from Montenegro to the United States to face criminal charges stemming from an alleged yearslong hacking campaign that targeted universities, businesses and government organizations around the world.
Amir Barati was arrested in Montenegro in June after U.S. authorities sought his detention through international law-enforcement channels. He was subsequently extradited to the United States, where he is expected to face federal charges in the Southern District of New York.
U.S. prosecutors allege that Barati was part of a large cybercrime operation connected to the Mabna Institute, an Iran-based organization accused of conducting cyber intrusions to steal academic research, intellectual property and other sensitive information. The alleged campaign began at least as early as 2013 and continued for several years.
According to a federal indictment unsealed in August 2026, the broader operation allegedly targeted 144 U.S. universities, 178 universities in other countries, at least 42 U.S. private-sector companies, 11 foreign companies, five U.S. government agencies and two nongovernmental organizations. Prosecutors allege that the hackers stole more than 31 terabytes of academic data and intellectual property.
The government estimates that the stolen information and unauthorized access caused or represented approximately $3.4 billion in costs and losses for U.S. universities. Prosecutors said the operation involved thousands of compromised email accounts belonging to professors and researchers.
The alleged hacking campaign relied heavily on spear-phishing, a technique in which targeted individuals receive deceptive messages designed to persuade them to disclose login credentials or otherwise provide access to protected computer systems.
Prosecutors allege that Barati played a supporting and coordinating role in the operation. According to the indictment, he allegedly tracked the progress of spear-phishing campaigns, exchanged stolen login credentials with other members of the group, prepared targeting lists, conducted reconnaissance of computer networks and helped create phishing messages.
The stolen information allegedly included academic journals, theses, dissertations, electronic books and other research materials. Prosecutors also allege that compromised university accounts were used to gain access to academic libraries and other resources.
The Justice Department has alleged that much of the activity was conducted for the benefit of Iranian entities, including Iran’s Islamic Revolutionary Guard Corps and Iranian universities. According to prosecutors, the Mabna Institute allegedly worked with Iranian governmental and private organizations to obtain research and other information through unauthorized computer access.
The alleged operation was not limited to universities. Prosecutors say members of the group also targeted private companies, government agencies and other organizations. Among the alleged victims were technology companies and defense contractors. Government agencies identified in the indictment included the Department of Labor and the Federal Energy Regulatory Commission, while the United Nations was also allegedly targeted.
The scale of the alleged campaign is one of the major factors behind the government’s prosecution. Rather than involving isolated attacks against individual computer systems, prosecutors describe a coordinated operation that allegedly targeted institutions possessing valuable research and intellectual property.
The federal case against Barati is part of a larger prosecution involving 17 Iranian nationals. The August superseding indictment added eight defendants to charges that had originally been announced in 2018. Prosecutors said the passage of time had not prevented investigators from identifying additional people allegedly connected to the campaign.
Barati’s extradition represents a significant development because many defendants accused of conducting cyberattacks from outside the United States never appear before a U.S. court. His transfer to American custody means prosecutors will now have an opportunity to pursue the charges against him through the federal criminal justice system.
Montenegrin authorities arrested Barati in the coastal town of Kotor following a request from U.S. authorities. His extradition followed cooperation between Montenegrin and American law-enforcement agencies, including the exchange of investigative and intelligence information.
The charges against Barati include conspiracy to commit computer intrusions, conspiracy to commit wire fraud, computer fraud and wire fraud. The indictment lists maximum statutory penalties for several of the charges, although those maximums do not represent a prediction of what sentence Barati would receive if convicted. Any sentence would ultimately depend on the charges proved, applicable sentencing rules and the court’s determination.
The case also illustrates the difficulties involved in prosecuting alleged cybercrime when the suspects, victims and computer infrastructure are spread across multiple countries. Investigators must coordinate across jurisdictions, obtain evidence from foreign governments and identify individuals who may be operating outside the reach of U.S. authorities.
International cooperation played a direct role in this case. Montenegro’s law-enforcement authorities detained Barati after receiving the U.S. request, and the country’s courts subsequently handled the extradition process. The cooperation allowed U.S. prosecutors to bring one of the defendants physically before an American court.
The allegations also have a national-security dimension because prosecutors say some of the stolen information was obtained for Iranian government-linked entities. The Justice Department has characterized the alleged activity as part of a broader effort to obtain valuable research and intellectual property through cyber operations.
The indictment alleges that the Mabna Institute worked with hackers-for-hire and other contractors to conduct intrusions for Iranian governmental, university and private-sector clients. Prosecutors say the organization effectively operated as a service provider for entities seeking access to information that would otherwise be protected by computer security systems.
The government’s allegations include claims that stolen university credentials were used to access online library systems. Prosecutors say some of the stolen academic materials were subsequently provided to Iranian universities or made available through websites serving customers in Iran.
U.S. authorities have also pursued other members of the alleged operation. The State Department’s Rewards for Justice program announced rewards of up to $10 million for information leading to the location of several defendants who remain outside U.S. custody.
Barati’s extradition does not establish his guilt. The federal indictment contains allegations made by prosecutors, and he remains entitled to the presumption of innocence unless the government proves the charges beyond a reasonable doubt in court.
The case will now proceed through the federal court system. Prosecutors will have to establish the elements of the charged offenses, including Barati’s alleged participation in the hacking conspiracy and the specific conduct attributed to him.
The prosecution is also notable because it demonstrates that alleged cybercrime committed overseas can continue to generate legal consequences years after the attacks occurred. The investigation began with conduct dating back more than a decade, yet U.S. authorities have continued pursuing additional defendants.
For universities and research institutions, the case highlights the value of cybersecurity protections around academic accounts and intellectual property. Academic institutions frequently maintain large amounts of valuable research while operating extensive networks involving students, professors, researchers and outside collaborators.
For federal law enforcement, the extradition represents an opportunity to bring one of the alleged participants into the U.S. justice system and pursue the charges in court. The proceedings may also provide additional information about the structure and activities of the broader alleged hacking network.
The next stages of the case will determine how prosecutors proceed against Barati and whether the evidence ultimately supports the government’s allegations. For now, the extradition is the latest development in a major international cybercrime prosecution involving alleged theft of academic and proprietary information on a global scale.
Key Legal Outcome
- Amir Barati was extradited from Montenegro to the United States to face federal criminal charges related to the alleged hacking campaign.
- He is among 17 Iranian nationals charged in a superseding federal indictment concerning the alleged cyber operation.
- Prosecutors allege the broader campaign targeted 144 U.S. universities, 178 foreign universities and numerous companies and government agencies.
- Barati is accused of helping coordinate spear-phishing campaigns, exchange compromised credentials, conduct network reconnaissance and create targeting lists.
- The charges remain allegations, and Barati is presumed innocent unless proven guilty in court.
Why It Matters
- The case demonstrates the reach of international cooperation in cybercrime prosecutions.
- It highlights the legal consequences of alleged theft of academic research and intellectual property.
- The prosecution illustrates how federal authorities can pursue alleged cybercriminal activity years after the underlying attacks.
- The case raises significant national-security concerns because prosecutors allege that some of the hacking benefited Iranian government-linked entities.
- Barati’s extradition could provide U.S. prosecutors with an opportunity to pursue one alleged participant directly in an American federal court.
