Loading story…
Amir Barati, an Iranian-Turkish national accused by U.S. authorities of participating in an Iranian state-linked academic espionage operation, has been extradited from Montenegro to the United States following his June 25 arrest. He faces a 14-count indictment including conspiracy to commit computer intrusions, wire fraud, computer fraud, and identity theft.
Prosecutors allege Barati was a key member of the Iran-based Mabna Institute, which operated on behalf of the Islamic Revolutionary Guard Corps from 2013 to 2017. The alleged campaign targeted universities, research institutions, private organizations, government agencies, and NGOs globally, compromising thousands of academic email accounts and stealing more than 31 TB of research, intellectual property, and employee account data. U.S. officials say the stolen material was provided to the Iranian government and sold to Iranian universities, causing claimed losses exceeding $3.4 billion.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
A U.S. 14-count superseding indictment was unsealed, charging 17 alleged Mabna Institute members in connection with the alleged state-linked intrusion campaign. The indictment included allegations against Barati for computer-intrusion conspiracy, wire fraud, computer fraud, and identity theft.
Montenegrin police arrested Barati, a dual Turkish-Iranian citizen, in Kotor while he was on vacation, pursuant to an FBI arrest warrant.
Iran International reported that Barati left Iran, moved to Turkey, obtained Turkish citizenship, and legally changed his name.
Between 2013 and 2017, the alleged Mabna Institute operation targeted about 8,000 professor email accounts and breached institutions worldwide. Prosecutors allege it stole more than 31 TB of academic data and intellectual property, which was provided to the Iranian government and sold to Iranian universities.
U.S. prosecutors allege that a Mabna Institute operation acting for Iran's IRGC began cyberattacks in 2013 against universities, research institutions, companies, government agencies, and NGOs. The campaign allegedly used spearphishing and stolen credentials to access email and online-library systems.
Iran International reported that Iran's Intelligence Ministry arrested Amir Barati in 2010 and coerced him into working for the ministry for several years.
Following a final Montenegrin court decision, Amir Barati was extradited to the United States to face charges over his alleged role in the Mabna Institute campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice unsealed a 14-count superseding indictment charging 17 Iranian nationals tied to the Tehran-based **Mabna Institute** with conducting a long-running cyber intrusion and theft campaign on behalf of the **Islamic Revolutionary Guard Corps** and other Iranian government and university clients. Prosecutors allege the operation, active since at least 2013, compromised more than **100,000 professors’ email accounts** worldwide, including about **8,000 accounts** across **144 U.S. universities** and **178 foreign universities**, and stole at least **31.5 terabytes** of academic research, intellectual property, and email contents. Authorities said the campaign also targeted at least five U.S. federal and state agencies, dozens of companies in the United States and abroad, NGOs, and media targets including **HBO**, with several defendants linked to the separate HBO hack-and-extortion case. The superseding indictment expands a 2018 case by adding eight defendants and alleges the stolen academic materials were monetized through **Megapaper.ir** and **Gigapaper.ir**; U.S. officials said American universities alone spent roughly **$3.4 billion** to procure and access the stolen data, while the State Department is offering up to **$10 million** for information leading to several of the accused.
Aug 22, 2026
U.S. authorities indicted three Iranian nationals—**Said Pourkarim Arabi, Mohammad Reza Espargham, and Mohammad Bayati**—for cyber intrusions conducted between 2015 and 2019 against aerospace and satellite technology companies, alleging they stole sensitive commercial information, intellectual property, and personal data on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. Reporting on the case linked the activity to Iranian espionage tradecraft associated with **Elfin (`APT33`)**, including spear-phishing, use of the **NanoCore RAT**, exploitation of **`CVE-2018-20250`** in WinRAR, and follow-on intrusion activity using malicious HTA files, `mshta.exe`, and PowerShell in regional targeting such as Saudi Arabia. The enforcement action aligns with broader U.S. efforts against Iranian cyber operators, including **OFAC sanctions** on **APT39 (Chafer)**, the **Rana Intelligence Computing Company** front, and MOIS-linked personnel for surveillance and intrusions targeting Iranian citizens, neighboring governments, and foreign organizations. Separate threat research also described an Iranian espionage campaign dubbed **Operation GhostShell**, which targeted aerospace and telecommunications firms across the Middle East, the United States, Russia, and Europe with the **ShellClient** RAT, a stealthy backdoor that disguised itself as legitimate Windows components and in newer variants used the **Dropbox API** for command-and-control.
Aug 15, 2026
U.S. authorities extradited Armenian national **Hambardzum Minasyan** to face charges for allegedly helping develop and operate the **RedLine** infostealer malware, a tool widely used to steal login credentials and other sensitive data from victims’ computers. Prosecutors accused Minasyan of maintaining key RedLine infrastructure, including virtual private servers, internet domains, malware distribution repositories, and a cryptocurrency account used to collect payments from affiliates who deployed the malware. The indictment charges Minasyan with conspiracy to commit access device fraud, conspiracy to violate the **Computer Fraud and Abuse Act**, and conspiracy to commit money laundering. The case follows the multinational **Operation Magnus** disruption of the RedLine and Meta infostealers in 2024, carried out with authorities in the United States, Belgium, the Netherlands, and **Eurojust**. U.S. officials had previously charged alleged co-conspirator **Maxim Rudometov**, identified as a RedLine developer and administrator, and also launched a public website for victims seeking information and assistance.
Jun 29, 2026