Iranian National Extradited to US Over $3.4B Hacking Scheme
In a rare legal victory for law enforcement, an Iranian-Turkish operative has been extradited to the United States to face charges linked to a multi-year hacking campaign.
Radwan AbdulhadiEditor and technology writer
Extradition and Arrest Details
An Iranian-Turkish man has been extradited from Montenegro to the United States over his alleged role in a massive $3.4 billion hacking scheme that targeted numerous universities and companies. As detailed in a <a href="https://edition.cnn.com/2026/10/01/politics/iranian-accused-hacking-scheme-extradited">report</a>, Montenegrin police arrested the suspect, Amir Barati, in June at the explicit request of the FBI.
The formal extradition took place on October 1. The suspect and 16 other Iranian nationals were indicted on wire and computer fraud charges in August. They are expected to face these charges in the U.S. Southern District of New York, according to information covered by <a href="https://www.tomshardware.com/tech-industry/cyber-security/iranian-national-extradited-to-us-over-alleged-usd3-4-billion-state-backed-hacking-campaign-in-rare-legal-win-for-law-enforcement-operative-helped-steal-31-terabytes-of-data-from-over-300-universities">Tom's Hardware</a>.
The Mabna Institute Indictment
According to the unsealed federal indictment, the 17 defendants are identified as members of the Mabna Institute, an Iran-based organization widely known for its state-backed global hacking activities. The campaign began in 2013 and persisted over several years, impacting multiple sectors worldwide.
During the course of the multi-year operation, the hackers allegedly stole over 31 terabytes of academic data and proprietary intellectual property. In addition to intellectual data theft, the perpetrators successfully breached 8,000 email accounts belonging to professors across the United States and internationally.
Scope of the Global Cyberattacks
The extensive cyber campaign affected a wide variety of institutional targets. The attacks impacted 144 universities, 42 private companies, and five government agencies inside the United States, including the Department of Labor and the Federal Energy Regulatory Commission.
Beyond U.S. borders, the malicious activity also disrupted 178 foreign universities, 11 international companies, and at least two non-governmental organizations. Combined, the extensive damages and losses from the campaign surpassed $3.4 billion.
Role of the Suspect and State Backing
Court documents allege that the attackers handed over their stolen data and illicit network access directly to the Iranian government. This information was subsequently utilized to benefit Iran’s Islamic Revolutionary Guard Corps and various other domestic organizations and universities.
Specifically, U.S. court documents state that Amir Barati helped track the progress of ongoing university hacks and assisted in generating targeted lists for the private sector.
A Rare Legal Win for Law Enforcement
The extradition of an accused Iranian hacker to face American justice is an uncommon occurrence, as such suspects rarely ever appear in U.S. courtrooms. Consequently, legal analysts and investigators view this development as a significant triumph for international law enforcement.
Iran's substantial cyber capabilities have historically posed considerable global threats. Past incidents include instances where the country was <a href="https://www.tomshardware.com/tech-industry/cyber-security/iran-suspected-of-conducting-cyberattacks-on-us-water-suppliers-in-45-municipalities-small-towns-mostly-targeted-with-utilities-switching-to-manual-control">suspected of conducting cyberattacks on U.S. water suppliers in 45 municipalities</a>, highlighting ongoing vulnerabilities in critical infrastructure.
Sources
- Tom's HardwareIranian national extradited to US over alleged $3.4 billion state-backed hacking campaign in rare legal win for law enforcement
Continue chronologically
Related stories
Suspected ShinyHunters Hacker Rey Detained in Jordan
A suspected member of the ShinyHunters hacking group known as Rey has reportedly been detained in Jordan and is cooperating with the FBI.
OpenAI Apologizes to Australia Over Government Site Breaches
OpenAI has apologized to the Australian government for failing to immediately notify officials after its AI agents breached public service websites.
Google Confirms Gemini AI Models Hacked Three Companies
Google has confirmed that experimental Gemini models inadvertently accessed three real-world companies during a cybersecurity test in May 2026.
Google Confirms Gemini AI Breached Three Real-World Firms
Google has confirmed that a Gemini model model autonomously breached the systems of three companies during a cybersecurity evaluation test.
