Mabna Institute: Iranian national extradited to US over alleged $3.4 billion state-backed hacking campaign in rare legal win for law enforcement — operative helped steal 31 terabytes of data from over 300 universities

Iranian Hacker Extradited to U.S. in $3.4 Billion Cyberespionage Case

A 36-year-old Iranian-Turkish national, Amir Barati, was extradited from Montenegro to the U.S. on October 1 to face charges tied to a massive, state-backed hacking operation that stole over 31 terabytes of academic and corporate data. Barati was arrested in June at the FBI’s request after Montenegro authorities detained him.

Barati and 16 other Iranian defendants all linked to the Mabna Institute, an Iran-based cyberespionage group were indicted in August on wire and computer fraud charges in the Southern District of New York. The group’s campaign, active from 2013 to at least 2017, targeted 144 U.S. universities, 42 private companies, and five government agencies, including the Department of Labor and the Federal Energy Regulatory Commission. Globally, the attacks compromised 178 universities and 11 companies, along with two NGOs, resulting in an estimated $3.4 billion in losses.

According to U.S. court documents, the stolen data including intellectual property and breached email accounts from 8,000 professors was handed over to the Iranian government, benefiting the Islamic Revolutionary Guard Corps and other state-linked entities. Barati’s role allegedly included tracking hacking progress and developing targeting lists for private-sector victims.

The extradition marks a rare legal victory, as Iranian cybercriminals seldom face U.S. prosecution. Iran’s cyber capabilities have drawn increasing scrutiny, with recent attacks linked to the country targeting U.S. water suppliers in 45 municipalities and a March breach wiping 200,000 devices while exfiltrating 50 terabytes of data.

Source: https://www.tomshardware.com/tech-industry/cyber-security/iranian-national-extradited-to-us-over-alleged-usd3-4-billion-state-backed-hacking-campaign-in-rare-legal-win-for-law-enforcement-operative-helped-steal-31-terabytes-of-data-from-over-300-universities

Mabna cybersecurity rating report: https://www.rankiteo.com/company/mabna

"id": "MAB1791123920",
"linkid": "mabna",
"type": "Cyber Attack",
"date": "10/2026",
"severity": "100",
"impact": "8",
"explanation": "Attack that could bring to a war"

{'affected_entities': [{'industry': 'Education',
                        'location': 'United States',
                        'name': '144 U.S. universities',
                        'type': 'Academic'},
                       {'location': 'United States',
                        'name': '42 private companies',
                        'type': 'Corporate'},
                       {'industry': 'Public Sector',
                        'location': 'United States',
                        'name': 'Department of Labor, Federal Energy '
                                'Regulatory Commission',
                        'type': 'Government'},
                       {'industry': 'Education',
                        'location': 'Global',
                        'name': '178 universities (global)',
                        'type': 'Academic'},
                       {'location': 'Global',
                        'name': '11 companies (global)',
                        'type': 'Corporate'},
                       {'location': 'Global',
                        'name': '2 NGOs',
                        'type': 'Non-Profit'}],
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': "8,000 professors' email "
                                              'accounts',
                 'sensitivity_of_data': 'High (intellectual property, '
                                        'government data)',
                 'type_of_data_compromised': 'Intellectual property, email '
                                             'accounts'},
 'description': 'A 36-year-old Iranian-Turkish national, Amir Barati, was '
                'extradited from Montenegro to the U.S. on October 1 to face '
                'charges tied to a massive, state-backed hacking operation '
                'that stole over 31 terabytes of academic and corporate data. '
                'The campaign targeted 144 U.S. universities, 42 private '
                'companies, and five government agencies, including the '
                'Department of Labor and the Federal Energy Regulatory '
                'Commission. Globally, the attacks compromised 178 '
                'universities and 11 companies, along with two NGOs, resulting '
                'in an estimated $3.4 billion in losses.',
 'impact': {'data_compromised': '31 terabytes',
            'financial_loss': '$3.4 billion',
            'systems_affected': 'Universities, private companies, government '
                                'agencies, NGOs'},
 'initial_access_broker': {'high_value_targets': 'Academic institutions, '
                                                 'private companies, '
                                                 'government agencies'},
 'investigation_status': 'Ongoing (extradition completed)',
 'motivation': 'State-backed espionage, intellectual property theft',
 'references': [{'source': 'U.S. court documents'}],
 'regulatory_compliance': {'legal_actions': 'Wire and computer fraud charges '
                                            '(Southern District of New York)'},
 'response': {'law_enforcement_notified': 'FBI, Montenegro authorities'},
 'threat_actor': 'Mabna Institute (Iran-based cyberespionage group)',
 'title': 'Iranian Hacker Extradited to U.S. in $3.4 Billion Cyberespionage '
          'Case',
 'type': 'Cyberespionage'}