Iranian accused of hacking American universities extradited from Montenegro
Montenegro extradited Iranian hacker Amir Barati, charged over the Mabna Institute university data-theft campaign.
Amir Barati, a 40-year-old dual Turkish-Iranian citizen, was extradited from Montenegro after his June 25 arrest on an FBI warrant. A U.S. indictment names him among 17 people over a Mabna Institute campaign prosecutors say operated for the IRGC. The group allegedly spearphished professors, compromised about 8,000 accounts from 2013 to 2017, and stole at least 31 terabytes from 144 U.S. universities, 42 U.S. companies, and 178 foreign universities. Prosecutors estimate $3.4 billion in damages and about $20 million in university remediation costs.
- Barati was arrested in Kotor, Montenegro, and a court approved extradition.
- DOJ ties the Mabna Institute campaign to Iran's IRGC.
- About 8,000 professor accounts and 31 terabytes were allegedly stolen.
- Targets included 144 U.S. universities and 178 foreign universities.
- Charges include computer intrusion, wire fraud, and identity theft conspiracies.
Full article486 words · extracted from therecord.media · click to collapse
An Iranian national accused by the U.S. of taking part in dozens of breaches involving the theft of academic data and intellectual property has been extradited from Montenegro. Amir Barati, a 40-year-old citizen of both Turkey and Iran, was arrested on June 25 by Montenegro’s Police Directorate after the FBI issued an arrest warrant. In August, the Justice Department named Barati in a 14-count indictment charging 17 people in relation to an expansive campaign prosecutors believe was run through an Iranian company known as the Mabna Institute on behalf of the Islamic Revolutionary Guard Corps (IRGC). A Montenegrin court issued a final decision to extradite Barati this week after he was detained in the coastal municipality Kotor during a vacation. Barati is accused of being a key figure in an operation that allegedly saw Iranian hackers breach email inboxes at universities and other research institutions worldwide, stealing at least 31 terabytes of information and intellectual property. The hackers are accused of stealing academic journals, theses, dissertations, and electronic books, targeting data across dozens of fields. U.S. officials claimed Barati’s group was responsible for $3.4 billion in damages. Prosecutors said Barati “was involved in tracking the progress of the spearphishing campaigns, exchanging login credentials for compromised accounts with other co-conspirators, creating targeting lists, conducting computer network reconnaissance, and crafting phishing messages.” The DOJ accused the group of breaching 144 American universities and 42 U.S. companies, as well as 178 foreign universities and at least 11 foreign companies. The university hacking campaign allegedly involved the successful targeting of about 8,000 email accounts belonging to professors between 2013 and 2017. They allegedly used stolen credentials to breach the professors’ accounts. The stolen documents were given to the government of Iran and were sold through two websites to universities in the country, the DOJ said. One website allowed customers in Iran to use stolen professor accounts to access the online library systems of multiple U.S. universities. Prosecutors said the universities spent about $20 million to investigate and remediate the breaches. Barati was charged with multiple counts of conspiracy to commit computer intrusions, wire fraud, computer fraud and identity theft. Iran International reported that Barati has a lengthy history as a hacker in Iran and launched multiple prominent groups like the Iran Black Hats Team and Digital Boys Underground Team that were accused of attacking Microsoft, MIT and other institutions. According to the news outlet, he was arrested by Iran’s Intelligence Ministry in 2010 and coerced into working for them for several years. He became a Turkish citizen after leaving Iran and changing his name in 2021.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.