Montenegro has extradited to the United States a man accused of belonging to the Iran-based Mabna Institute, a group prosecutors say hacked universities, companies and government agencies for Iran's Islamic Revolutionary Guard Corps, SecurityWeek reported Friday. Amir Barati, 40, faces a 14-count superseding indictment in New York over a campaign that allegedly caused more than $3.4 billion in losses.

What Happened

Barati, who holds both Turkish and Iranian citizenship, was arrested June 25 by Montenegrin authorities acting on an FBI warrant. The Associated Press reported that the arrest took place in the coastal town of Kotor and that Montenegrin police described him as a high-profile target linked to cybercrime and organized crime. His extradition was announced Thursday.

In New York, he faces charges including conspiracy to commit computer fraud, hacking and identity theft. According to SecurityWeek, prosecutors say the hacking began in 2013 and was carried out on behalf of the IRGC as well as private organizations.

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say

The alleged targets were 144 U.S. universities and 178 foreign universities, 42 U.S. companies and 11 foreign companies, five U.S. government agencies and at least two nongovernmental organizations. Prosecutors say the intrusions yielded more than 31 terabytes of scientific resources, academic data and intellectual property, along with access to employee email accounts. The stolen material was allegedly passed to the Iranian government and sold to Iranian universities.

SecurityWeek reported that Barati moved to Turkey in 2021 and legally changed his name there. The U.S. is offering rewards of up to $10 million for information on five other Iranian hackers named in the same case.

Why It Matters

Indictments of Iranian state-linked hackers are common, but arrests are not. Defendants usually stay in Iran, which does not extradite its citizens to the United States, so charges often function more as public attribution than as a path to trial. SecurityWeek called the extradition extremely rare for that reason.

The case shows how such defendants are typically caught: by traveling to a country that cooperates with U.S. law enforcement. The AP said the handover followed an exchange of operational and intelligence information between Montenegrin and U.S. agencies.

The Mabna case is also one of the largest documented academic espionage campaigns. When the Justice Department first charged Mabna-linked defendants in 2018, it described a long-running effort to break into university accounts through password spraying and phishing, then take research data and academic resources. Universities remain attractive targets because they hold valuable research and often run sprawling, loosely managed networks with large numbers of user accounts.

Context

The original 2018 indictment charged nine Iranians, and none had appeared in a U.S. courtroom before this extradition. That makes Barati, charged through a superseding indictment, the first Mabna defendant in U.S. custody.

What to Watch

Barati is expected to make an initial appearance in federal court in New York, where he will be arraigned on the 14 counts. Observers will watch whether the Justice Department unseals more details of the superseding indictment, including how investigators linked him to the Mabna operation and traced him after his name change.

Tehran's response is another open question, and the extradition of a dual national from a European country could become a diplomatic issue. The reward offer for the five remaining defendants signals that U.S. authorities hope others may also travel beyond Iran's borders.