Iranian hacker accused of draining 31TB from university inboxes extradited to the US
Montenegro approved extraditing Amir Barati over an alleged IRGC-linked theft of 31TB from universities.
73
Threat actor
Islamic Revolutionary Guard Corps
- Mentions · 7d0
- Mentions · 30d3
- All mentions6
- First seenAug 20, 2026
- Last mentioned26d ago
Timeline
6 articles · newest firstIn Rare Move, Iranian Hacker Accused of Working for IRGC Extradited to US
Montenegro extradited alleged Mabna Institute hacker Amir Barati, accused of IRGC-linked intrusions causing over $3.4 billion in losses.
64
Iranian accused of hacking American universities extradited from Montenegro
Montenegro extradited Iranian hacker Amir Barati, charged over the Mabna Institute university data-theft campaign.
50
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
48
US Indicts 17 Iranians Over Years
US unsealed superseding indictment charging 17 Mabna Institute Iranians for IRGC-linked espionage stealing 31TB from universities, companies, and government agencies.
74
US charges 17 Iranian hackers over 31-terabyte academic data theft
US indicts 17 Iranian Mabna Institute hackers who stole 31TB of academic data from universities, companies, and agencies via spearphishing.
52
Appears with
- Mabna Institutethreat actor · 6
- HBOvictim · 2
- US Department of Justiceorganization · 2
- Mabna Instituteorganization · 2
- Iran Black Hats Teamthreat actor · 2
- Digital Boys Underground Teamthreat actor · 2
- Amir Baratithreat actor · 2
- U.S. Department of Justiceorganization · 2
- Federal Bureau of Investigationorganization · 2
- 144 US universitiesvictim · 1
- Grandoreirothreat actor · 1
- Cruciferrathreat actor · 1
- Montenegro Police Directorateorganization · 1
- FBIorganization · 1
- Microsoft Defenderproduct · 1
- 178 foreign universitiesvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.