MONTENEGRO’S authorities have extradited Amir Barati, a dual Turkish and Iranian citizen, to the United States after arrest in June and court approval in October 2026. Barati is charged in a 14-count indictment related to a long-running Iranian cyber campaign attributed to the Mabna Institute on behalf of the Islamic Revolutionary Guard Corps (IRGC).
US prosecutors allege that from 2013 to 2017 Barati and others conducted mass spearphishing and credential stuffing against universities and research institutions, stealing data and enabling access to thousands of professor email accounts.
The operation, described by US officials as spanning at least 150 US universities and 42 US companies, among others, reportedly compromised roughly 8,000 professor accounts and resulted in the alleged theft of at least 31 terabytes of data. The stolen information was said to include academic journals, theses, dissertations, and electronic books, with damage estimated at about $3.4 billion.
Prosecutors say Barati was directly involved—writing phishing emails, building target lists, conducting network reconnaissance, sharing credentials, and monitoring campaign progress—and that stolen data was sent to the Iranian government and sold through two websites. The indictment also notes that some of the compromised credentials were used to access US university library systems. Montenegro’s extradition decision follows prior reporting by Iran International and the DOJ’s public statements regarding the Mabna‑IRGC network.