Iranian hacker Amir Barati faces extradition to the US over an alleged Iranian campaign that stole 31TB of data from universities.

Amir Barati spent June 25 getting arrested in Montenegro, and this week a Montenegrin court signed off on sending him to the United States. He’s a dual Turkish and Iranian citizen, 40 years old, picked up by Montenegro’s Police Directorate after the FBI issued a warrant.

“He is accused of committing the following crimes: conspiracy to commit computer fraud and computer hacking, as well as identity theft, by conducting massive hacking attacks on the infrastructure of the United States of America since 2013, as an associate of a legal entity from the territory of Iran – at over 150 universities in the United States of America, causing damage estimated at more than 3.4 billion US dollars.” reads the press release published by Montenegro’s Police.

Barati’s hacking career reportedly began in Iran, where he founded the Iran Black Hats Team and later co-founded Digital Boys Underground Team. Archived records linked the groups to attacks on academic, commercial and government targets, including NASA, Microsoft and MIT. After his 2010 arrest by Iran’s Intelligence Ministry, sources said he was recruited as an intelligence asset, although this could not be independently confirmed. Iran International reports that Barati left Iran for Turkey in 2021, gained Turkish citizenship and changed his name. He was later arrested while on holiday in Montenegro. A US indictment subsequently linked him to the Mabna network and its alleged IRGC-backed campaign targeting universities.

Barati was arrested in Kotor, a coastal town in Montenegro, while he was on vacation.

In August, the US Justice Department named him in a 14-count indictment against 17 people. Prosecutors allege they were part of an operation run through the Iranian Mabna Institute on behalf of the Islamic Revolutionary Guard Corps.

The scale of the campaign was significant. Prosecutors say the group hacked email accounts at universities and research institutions around the world and stole at least 31 terabytes of data. US officials estimate the damage at $3.4 billion.

The targets weren’t random, either. Academic journals, theses, dissertations, electronic books, pulled from 144 American universities and 42 US companies, plus 178 foreign universities and at least 11 foreign companies. Between 2013 and 2017, the campaign allegedly compromised roughly 8,000 professor email accounts, using stolen credentials to get in and stay in.

Prosecutors describe Barati as directly involved in the operation, not just someone working in the background. The Record Media quoted the government saying he helped track the progress of the spearphishing campaigns. He also allegedly shared stolen credentials with other members, built lists of targets, carried out network reconnaissance, and wrote phishing emails himself.

According to the DOJ, the stolen data was sent to the Iranian government and also sold through two websites to universities in Iran. One of those sites allowed users to log in to US university library systems using stolen credentials belonging to professors. The affected universities also spent about $20 million investigating the attacks and repairing the damage.

Iran International’s reporting shows that Barati’s hacking activities go back years before the current indictment. He reportedly became known in Iran’s hacking scene and founded groups including the Iran Black Hats Team and the Digital Boys Underground Team. Both groups have been accused of targeting organizations such as Microsoft and MIT.

Iran International also confirmed that Montenegro plans to extradite Barati to the United States.

“Montenegro will extradite Iranian-Turkish hacker Amir Barati to the United States, where he faces charges over a sweeping cyber campaign that US prosecutors say stole research and data for Iran’s Revolutionary Guards and other entities.” state Iran International.

Barati now faces multiple counts of conspiracy to commit computer intrusions, wire fraud, computer fraud, and identity theft. Full reporting and the extradition order:

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Iranian hacker)

This week on the Lock and Code podcast…

Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data’s relationship with the entire global economy: “Data is the new oil.”

Pithy as the phrase sounds, it is undeniably true.

Data steers decisions at businesses of every size. Data created entirely new industries built around its capture. And, for a select number of companies, data has produced billions—if not trillions—of dollars in value.

So how is it that, on the dark web, your stolen identity can be purchased for just 95 cents?

That’s what a Malwarebytes researcher found last month after spending 48 hours inside the dark web to investigate cybercrime. Across a variety of forums and directories, he found subscription plans for malware that steals information once implanted on a device. He found guides for deploying social engineering scams. He found people selling their services to build fake websites that trick people into handing over their usernames and passwords. And he found one of the dark web’s most traded commodities—personal data, packaged together about individual people, to help a cybercriminal commit identity fraud.

These packages are called “fullz.” For victims in the United States, a fullz contains a full name, Social Security Number, date of birth, address, and other personal details. That is enough, on its own, for a cybercriminal to potentially open a bogus line of credit, file a fake tax return, access financial accounts, or obtain medical services under someone else’s name.

As we wrote on Malwarebytes Labs:

“For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”

It’s the kind of risk that could scare anyone, especially considering the scale behind it. In just the first six months of 2026, Malwarebytes found more than 7,500 compromised data sets on the dark web containing more than 8.4 billion records.

And yet, even today, cybersecurity professionals still get asked why anyone should bother protecting their data.

The public, understandably, are exhausted. With data breaches happening every week—if not every day—cybersecurity can start to feel pointless. With young people unable to build financial security, they start believing that they have nothing worth stealing. And with Big Tech already collecting our every movement, behavior, click, and concern, people understandably feel powerless to fight any kind of data abuse, be it corporate or criminal.

So today’s episode approaches the question from a different direction. This isn’t about why you should protect yourself—plenty of company websites will tell you that, and most of them rely on fear. This is about why hackers want your data in the first place.

Today, on the Lock and Code podcast, host David Ruiz explains how cybercriminals turn a single repeated password into account takeover, how a screenshot of your house from Google Maps became a tool in extortion emails, and why the most benign information about you—an address, an age, one public photo—is often the most useful data a stranger can buy.

Tune in today to listen to the full episode.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

---

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.