Montenegro extradites Amir Barati, accused of hacking US universities for Iran
Montenegro extradited Turkish-Iranian Amir Barati to face US charges over a university hacking campaign that US officials say did $3.4 billion in damage. Where he chose to travel decided the case: police picked him up on holiday in Kotor, nine years after the charged hacking ended.
The Watch · Security desk
What happened
- Montenegrin police arrested him on June 25, 2026, acting on a direct arrest request from US authorities and the FBI.
- In August the Justice Department named him in a 14-count indictment of 17 people over a campaign it says ran through Iran's Mabna Institute for the IRGC.
- The group is accused of breaching 144 American universities, 42 US companies, 178 foreign universities and at least 11 foreign companies.
- About 8,000 professors' email accounts were allegedly broken into between 2013 and 2017 with stolen credentials.
- Stolen material went to Iran's government and was sold through two websites, one of them letting Iranian customers log into US university library systems.
Why it matters
- What it sets up precedent Montenegrin police have now located and arrested seven FBI-wanted people in three years, each within a very short time, so a US warrant there tends to be executed once the defendant arrives.
- What it limits constraint Claims of a wider extradition route through small European states rest on one country's record, and Montenegro did not say what the other six people were wanted for.
- Who's exposed exposure For universities the extradition changes nothing about current exposure: the intrusions charged here are dated 2013 to 2017.
Next story · Product · yesterday
Filing in OpenAI recording-device case lists one-way tickets to Saudi ArabiaConfirmed5 publishers
The charging account gives Barati a specific role. He "was involved in tracking the progress of the spearphishing campaigns, exchanging login credentials for compromised accounts with other co-conspirators, creating targeting lists, conducting computer network reconnaissance, and crafting phishing messages," prosecutors said [14]. He faces multiple counts of conspiracy to commit computer intrusions, wire fraud, computer fraud and identity theft [8].
By the Justice Department's account, the group took at least 31 terabytes, including academic journals, theses, dissertations and electronic books [9]. Montenegro's government says the stolen data and access to compromised university accounts were used for the benefit of the IRGC and other Iranian users, including universities based in Iran [15].
The $3.4 billion damage figure comes from US officials [11]. Montenegro's statement repeats it and puts the number of US universities hit at more than 150 [12], above the Justice Department's count. The one cost prosecutors break out is about $20 million that universities spent investigating and remediating the breaches [16]. That is about 0.6% of the headline figure: $20 million divided by $3.4 billion [19]. The Record and the Montenegrin statement do not say how the larger number was calculated.
Barati's background comes from a single outlet. Iran International reported, as cited by The Record, that he has a long history as a hacker in Iran [20]. It said he launched the Iran Black Hats Team and the Digital Boys Underground Team, groups accused of attacking Microsoft, MIT and other institutions [20]. The outlet also reported that Iran's Intelligence Ministry arrested him in 2010 and coerced him into working for it for several years [21]. He became a Turkish citizen after leaving Iran and changing his name in 2021, according to the same report [21].
The handover of Barati [2] ran through NCB Interpol Podgorica, with support from the Special Police Unit, after the High Court in Podgorica issued a final ruling allowing extradition [1][4]. Until his arrest, Montenegro's government said, he was a high-profile target in cybercrime and organized crime. The warrant was issued to secure his appearance in criminal proceedings in New York [13].
What to watch
- Barati's first appearance in the New York proceedings and whether he contests the charges.
- Arrests of any of the other 16 defendants named in the 14-count indictment, and in which countries.
- Any US filing that shows how the $3.4 billion damage figure was calculated.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+20
- Incentives40
- Confidence70
Perspective Coverage
6 publishers- Builder
- Builder 12%
- Operator
- Operator 77%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Officers of NCB Interpol Podgorica, with support from the Special Police Unit, extradited A.B. (40), a citizen of Turkey and Iran, to the United States under a final ruling of the High Court in Podgorica permitting extradition.
- [2]
Amir Barati, a 40-year-old citizen of both Turkey and Iran, has been extradited from Montenegro to the US.
- [3]
NCB Interpol Podgorica officers, with the Kotor security department, located and arrested A.B. in the municipality of Kotor on 25 June 2026, on a direct arrest request issued by US authorities and the FBI.
- [4]
A Montenegrin court issued a final decision to extradite Barati after he was detained in the coastal municipality of Kotor during a vacation.
- [5]
In August, the Justice Department named Barati in a 14-count indictment charging 17 people over a campaign prosecutors believe was run through an Iranian company known as the Mabna Institute on behalf of the IRGC.
- [6]
The DOJ accused the group of breaching 144 American universities and 42 US companies, as well as 178 foreign universities and at least 11 foreign companies.
- [7]
The campaign allegedly involved the successful targeting of about 8,000 email accounts belonging to professors between 2013 and 2017, breached using stolen credentials.
- [8]
Barati was charged with multiple counts of conspiracy to commit computer intrusions, wire fraud, computer fraud and identity theft.
- [9]
The hackers allegedly stole at least 31 terabytes of information and intellectual property, including academic journals, theses, dissertations and electronic books.
- [10]
The DOJ said stolen documents were given to the government of Iran and sold through two websites to universities in Iran; one website let customers in Iran use stolen professor accounts to access the online library systems of multiple US universities.
- [11]
US officials claimed Barati's group was responsible for $3.4 billion in damages.
- [12]
Montenegro's government said that since 2013, as an associate of an Iran-based legal entity, A.B. carried out mass hacking attacks on more than 150 US universities, causing damage estimated at more than $3.4 billion.
- [13]
Until his arrest, A.B. was considered a high-profile target in cybercrime and organized crime; the arrest warrant was issued to secure his presence in criminal proceedings against him in New York on multiple charges.
- [14]
Prosecutors said Barati "was involved in tracking the progress of the spearphishing campaigns, exchanging login credentials for compromised accounts with other co-conspirators, creating targeting lists, conducting computer network reconnaissance, and crafting phishing messages."
- [15]
Montenegro's government said the stolen data and access to compromised university accounts were used for the benefit of the IRGC and other Iranian users, including Iran-based universities.
- [16]
Prosecutors said the universities spent about $20 million to investigate and remediate the breaches.
- [17]
Cooperation between NCB Interpol Podgorica and the FBI has in the past three years resulted in locating and arresting a total of seven people in Montenegro wanted by the FBI and US judicial authorities, all located and arrested in a very short time by the FAST team of NCB Interpol Podgorica on the basis of intelligence exchange.
- [18]
Barati was arrested about nine years after the end of the 2013-2017 activity described by the DOJ.
- [19]
The roughly $20 million universities spent on investigation and remediation is about 0.6% of the $3.4 billion damage figure.
- [20]
Iran International reported that Barati has a lengthy history as a hacker in Iran and launched groups including the Iran Black Hats Team and Digital Boys Underground Team, which were accused of attacking Microsoft, MIT and other institutions.
- [21]
According to Iran International, Barati was arrested by Iran's Intelligence Ministry in 2010 and coerced into working for it for several years, and became a Turkish citizen after leaving Iran and changing his name in 2021.
Sources
5 independent publishers whose own reporting we read for this story.
- Montenegro government
gov.me
1 article · October 1, 2026
- scworld.comIranian hacker Amir Barati faces extradition to the US over alleged data theft campaign
1 article · October 5, 2026
- securityaffairs.comIranian hacker accused of draining 31TB from university inboxes extradited to the US
1 article · October 5, 2026
- securityweek.comIn Rare Move, Alleged Iranian State Hacker Extradited to US
2 articles · October 2, 2026
- therecord.mediaIranian accused of hacking American universities extradited from Montenegro
1 article · October 1, 2026
- tomshardware.comIranian national extradited to US over alleged $3.4 billion state-backed hacking campaign in rare legal win for law enforcement
1 article · October 4, 2026
Topics and entities
Topics
- University cybersecurity
- State-Sponsored Hacking
Entities
- Mabna Institute
- Islamic Revolutionary Guard Corps
- NCB Interpol Podgorica
- U.S. Department of Justice
- Iran Black Hats Team
- Federal Bureau of Investigation
- Digital Boys Underground Team
- Iran International