Security3 publishers2 min readPublished
Montenegro extradites Amir Barati, accused of hacking US universities for Iran
Montenegro extradited Turkish-Iranian Amir Barati to face US charges over a university hacking campaign that US officials say did $3.4 billion in damage. Where he chose to travel decided the case: police picked him up on holiday in Kotor, nine years after the charged hacking ended.
The Watch · Security desk
What happened
- Montenegrin police arrested him on June 25, 2026, acting on a direct arrest request from US authorities and the FBI.
- In August the Justice Department named him in a 14-count indictment of 17 people over a campaign it says ran through Iran's Mabna Institute for the IRGC.
- The group is accused of breaching 144 American universities, 42 US companies, 178 foreign universities and at least 11 foreign companies.
- About 8,000 professors' email accounts were allegedly broken into between 2013 and 2017 with stolen credentials.
- Stolen material went to Iran's government and was sold through two websites, one of them letting Iranian customers log into US university library systems.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- precedent Montenegrin police have now located and arrested seven FBI-wanted people in three years, each within a very short time, so a US warrant there tends to be executed once the defendant arrives.
- constraint Claims of a wider extradition route through small European states rest on one country's record, and Montenegro did not say what the other six people were wanted for.
- exposure For universities the extradition changes nothing about current exposure: the intrusions charged here are dated 2013 to 2017.
The charging account gives Barati a specific role. He "was involved in tracking the progress of the spearphishing campaigns, exchanging login credentials for compromised accounts with other co-conspirators, creating targeting lists, conducting computer network reconnaissance, and crafting phishing messages," prosecutors said [12]. He faces multiple counts of conspiracy to commit computer intrusions, wire fraud, computer fraud and identity theft [13].
By the Justice Department's account, the group took at least 31 terabytes, including academic journals, theses, dissertations and electronic books [14]. Montenegro's government says the stolen data and access to compromised university accounts were used for the benefit of the IRGC and other Iranian users, including universities based in Iran [18].
The $3.4 billion damage figure comes from US officials [10]. Montenegro's statement repeats it and puts the number of US universities hit at more than 150 [11], above the Justice Department's count. The one cost prosecutors break out is about $20 million that universities spent investigating and remediating the breaches [9]. That is about 0.6% of the headline figure: $20 million divided by $3.4 billion [1]. The Record and the Montenegrin statement do not say how the larger number was calculated.
Barati's background comes from a single outlet. Iran International reported, as cited by The Record, that he has a long history as a hacker in Iran [15]. It said he launched the Iran Black Hats Team and the Digital Boys Underground Team, groups accused of attacking Microsoft, MIT and other institutions [15]. The outlet also reported that Iran's Intelligence Ministry arrested him in 2010 and coerced him into working for it for several years [16]. He became a Turkish citizen after leaving Iran and changing his name in 2021, according to the same report [16].
The handover of Barati [2] ran through NCB Interpol Podgorica, with support from the Special Police Unit, after the High Court in Podgorica issued a final ruling allowing extradition [1][4]. Until his arrest, Montenegro's government said, he was a high-profile target in cybercrime and organized crime. The warrant was issued to secure his appearance in criminal proceedings in New York [19].
What to watch
- Barati's first appearance in the New York proceedings and whether he contests the charges.
- Arrests of any of the other 16 defendants named in the 14-count indictment, and in which countries.
- Any US filing that shows how the $3.4 billion damage figure was calculated.