Amir Barati, allegedly affiliated with the Iran-based Mabna Institute and the Islamic Revolutionary Guard Corps, was extradited to the US following an FBI arrest warrant executed by Montenegrin authorities. He is indicted for cyber intrusions against 144 US universities, 178 foreign universities, 42 US private companies, 11 foreign companies, five US government agencies, and at least two NGOs. The attacks, ongoing since 2013, involved theft of over 31 terabytes of academic and intellectual property data and employee email accounts, causing financial losses exceeding $3.4 billion. The stolen data was reportedly transferred to the Iranian government and sold to Iranian universities. The US government has issued rewards for information on other Mabna Institute members. The extradition is unusual given typical operational constraints of Iranian state hackers.

The cyberattacks attributed to Amir Barati and the Mabna Institute caused significant financial losses exceeding $3.4 billion. The theft of over 31 terabytes of scientific resources and intellectual property potentially undermines academic and research institutions' competitive advantage and confidentiality. The compromise of employee email accounts may have led to further information exposure. The attacks targeted a broad range of entities including universities, private companies, government agencies, and NGOs, indicating a wide-reaching impact on multiple sectors.

This report concerns a law enforcement action and indictment rather than a specific software vulnerability or exploit. No direct mitigation actions apply. Organizations should continue to follow best practices for protecting sensitive academic and intellectual property data and monitor for indicators of compromise related to Mabna Institute activity as per threat intelligence advisories.