Amir Barati extradited to US over alleged $3.4 billion hacking scheme

Extradition over alleged global hacking campaign

An Iranian-Turkish man, Amir Barati, was extradited to the United States from Montenegro over his alleged involvement in a $3.4 billion hacking scheme. The extradition took place on October 1 and was a rare move involving someone accused of state-sponsored attacks.

Montenegrin police arrested Barati in June at the FBI's request. He and 16 other Iranians were indicted on wire and computer fraud charges in August and are expected to face the charges in the U.S. Southern District of New York.

Indictment details extensive targets

According to the indictment, the 17 defendants are members of Mabna Institute, an Iran-based company known for state-backed global hacking activities. The campaign began in 2013 and lasted several years. The defendants allegedly stole over 31 terabytes of academic data and intellectual property and breached 8,000 email accounts belonging to professors in the U.S. and worldwide.

The attack affected 144 universities, 42 private companies and five government agencies, including the Department of Labor and the Federal Energy Regulatory Commission. It also affected 178 universities and 11 companies abroad, as well as at least two NGOs. The reported losses and damages exceeded $3.4 billion.

Alleged role and wider cyber context

U.S. court documents alleged that Barati helped track the progress of the university hacks and helped create targeting lists for the private sector. The attackers reportedly handed stolen data and illicit access to the Iranian government, which then used them to benefit Iran's Islamic Revolutionary Guard Corps and other Iranian organizations and universities.

The extradition is widely seen as a win for law enforcement because accused Iranian hackers rarely face U.S. courts. Iran was suspected of conducting cyberattacks on U.S. water suppliers in 45 municipalities in August. In March, an Iranian-linked hacking group claimed an attack that wiped over 200,000 devices clean and extracted over 50 TB of data.