Man arrested on holiday in Montenegro to face US charges over IRGC hacking campaign

Amir Barati, a 40-year-old Iranian-Turkish dual national, was on vacation in the Montenegrin coastal town of Kotor when Montenegrin police and Interpol arrested him on 25 June at the request of US authorities, including the FBI.

A Montenegrin court has issued a final decision to extradite Barati to the United States. He faces charges in New York including conspiracy to commit computer fraud, hacking, identity theft, wire fraud and conspiracy to commit computer intrusions.

Montenegrin police called him a 'high-profile' target wanted in connection with cybercrime and organised crime. His arrest and extradition followed an exchange of operational and intelligence information between Montenegrin and US law-enforcement agencies.

US prosecutors allege that Barati began carrying out large-scale cyberattacks against US infrastructure in 2013 while working with an Iran-based entity, later identified as the Mabna Institute.

He had been arrested by Iran’s Intelligence Ministry in 2010 and coerced into working for it for several years, according to the allegations. Barati later left Iran, became a Turkish citizen and changed his name in 2021.

Between 2013 and 2017, Barati and his alleged co-conspirators targeted about 8,000 email accounts belonging to university professors. The Justice Department accused the group of breaching 144 American universities and 42 US companies, along with 178 foreign universities and at least 11 foreign companies.

The alleged attacks targeted more than 150 US universities and caused an estimated $3.4 billion in damage. Universities spent about $20 million investigating and fixing the breaches.

Prosecutors said Barati “was involved in tracking the progress of the spearphishing campaigns, exchanging login credentials for compromised accounts with other co-conspirators, creating targeting lists, conducting computer network reconnaissance, and crafting phishing messages.”

Barati and others allegedly took at least 31 terabytes of information and intellectual property from the institutions they breached. Prosecutors said the stolen data and access to compromised university accounts were used to benefit Iran’s Islamic Revolutionary Guard Corps (IRGC) and other Iranian organisations, including universities.

The stolen documents were given to the Iranian government and sold through two websites to universities in the country, according to the allegations.

In August, the Justice Department named Barati in a 14-count indictment charging 17 people in connection with the campaign, which prosecutors said operated through the Mabna Institute on behalf of the IRGC.