Iranian-Turkish Man Accused in University Hacking Campaign Extradited to U.S.
Summary
Amir Barati was extradited from Montenegro to face U.S. charges tied to an alleged campaign that stole academic data from universities and research institutions worldwide.
Key points
- Montenegro extradited Barati after his arrest on a U.S. warrant.
- A 14-count indictment charges him in connection with an alleged academic data theft campaign.
- U.S. prosecutors say the campaign was run through the Mabna Institute on behalf of Iran’s IRGC.
- The alleged targets included 144 U.S. universities, 178 foreign universities, and companies in the U.S. and abroad.
- Authorities allege the hackers stole at least 31 terabytes of information and targeted about 8,000 professors’ email accounts from 2013 to 2017.
- Prosecutors allege spear-phishing and stolen credentials were used to access accounts and research materials.
Article Details
- Event Type
- Extradition of an Iranian-Turkish national to the United States to face charges related to an alleged academic espionage and data-theft campaign.
- Impact
- Prosecutors allege the campaign stole at least 31 terabytes of research data and intellectual property, targeted 144 U.S. universities, 42 U.S. companies, 178 foreign universities, and at least 11 foreign companies, and caused $3.4 billion in damages. The DOJ said affected universities spent about $20 million investigating and remediating breaches.
MITRE ATT&CK
T1078 · Valid AccountsProsecutors alleged that the group exchanged credentials for compromised accounts and used stolen credentials to access professors' accounts.T1114.002 · Remote Email CollectionThe alleged operation breached email inboxes and stole information from university accounts.T1566.002 · Spearphishing LinkProsecutors said the alleged campaign used spearphishing messages to target university accounts.T1595 · Active ScanningProsecutors said Barati conducted computer network reconnaissance as part of the alleged operation.
People
Threat Actors
Digital Boys Underground TeamIran International reported that Barati launched this group, which was accused of attacking Microsoft, MIT, and other institutions.Iran Black Hats TeamIran International reported that Barati launched this group, which was accused of attacking Microsoft, MIT, and other institutions.Islamic Revolutionary Guard Corps (IRGC)Prosecutors allege the campaign linked to the Mabna Institute was conducted on behalf of the IRGC.Mabna InstituteIranian company prosecutors say was used to run the alleged academic espionage campaign.
Countries
IranAmir Barati, a 40-year-old citizen of both Turkey and Iran, was arrested on June 25 by Montenegro’s Police Directorate after the FBI issued an arrest warrant.MontenegroAmir Barati, an Iranian-Turkish national accused of helping carry out a large academic espionage campaign, has been extradited from Montenegro to face U.S.TurkeyAmir Barati, a 40-year-old citizen of both Turkey and Iran, was arrested on June 25 by Montenegro’s Police Directorate after the FBI issued an arrest warrant.