The Kinglet’s rookie mistake: how an Iranian hacker was caught at US request

Shahed AlaviIran International

A Turkish-Iranian man arrested in Montenegro at the request of the United States spent years working as an asset of Iran's Intelligence Ministry after rising to become one of the country's most accomplished hackers, an Iran International investigation has found.

Amir Barati allegedly built his reputation by founding two of Iran's earliest and most prolific hacking groups, targeting hundreds of governments, university and commercial websites across the world before, according to multiple sources familiar with his activities, being recruited by Iranian intelligence after his arrest in 2010.

From then on, they say, he enjoyed years of apparent protection from prosecution while continuing his cyber activities.

After leaving Iran in 2021, Barati settled in Turkey, acquired Turkish citizenship by purchasing a luxury apartment in Istanbul, and later changed both his first and last names in what appears to have been an effort to distance himself from his past. Turkish citizenship shielded him from extradition to the United States, but it ultimately failed to shield him from the FBI.

Barati was arrested on June 25 while holidaying in the Montenegrin resort town of Kotor. US prosecutors accuse him of participating in a long-running cyber campaign involving computer fraud, hacking, identity theft and unauthorized access to protected computer systems. He is expected to face extradition proceedings.

This investigation is based on open-source records, court documents reviewed by Iran International, and interviews with one of Barati's former acquaintances and several cybersecurity experts familiar with his activities, all of whom spoke on condition of anonymity.

One of Iran's earliest hackers

Little is known about Barati's early life. Born in Mashhad in February 1986, he had already established himself as a cybersecurity specialist by his mid-twenties. A judicial document from 2014 described him as an expert in the field, but the available evidence suggests he earned that reputation years earlier.

At just 21, Barati founded Iran Black Hats Team (IBH), one of the earliest known Iranian hacking groups. Its first documented attack came in August 2006, when members defaced a subdomain belonging to Thailand's Naresuan University.

Over the following eight years the group hacked hundreds of governments, university and commercial websites in the United States, Britain, Saudi Arabia, across the European Union and elsewhere in Asia. By 2013, one specialist blog ranked IBH nineteenth worldwide for website defacements, attributing 458 successful attacks to the group.
Archived internet records link Barati directly to the group's website through domain-registration details that included his email address and Iranian mobile phone number. They also reveal the online alias he preferred above all others: Kinglet—a name meaning "little king."
"Amir saw himself as the king of this field," one cybersecurity expert told Iran International. "The fact that, despite years of hacking, he had escaped investigation and prosecution—and that his name never appeared in any US government statement—reinforced that sense of superiority."

In 2009, Barati expanded his activities by co-founding a second group, Digital Boys Underground Team, with Arman Kahzadian, another young Iranian hacker.

Money, rather than ideology, appears to have been his principal motivation.

Although DBUT sometimes accompanied its attacks with quotations invoking Persian pride or Islamic tradition, cybersecurity researchers who tracked the group say its members were primarily interested in stealing data, selling access and building a reputation that could be monetized.

"That credibility could be turned into money," one expert said. "That was Amir's objective throughout those years."

According to archived records, the group carried out more than 1,000 attacks against websites belonging to hundreds of academic, commercial, government and military institutions, including NASA, Microsoft, MIT and the US Army, while launching nearly 8,000 mass attacks against servers.

One cybersecurity expert who followed the pair's activities said Barati quickly recognised Kahzadian's abilities.

"Amir was several years older than Arman, but he immediately saw his talent and began what became a long collaboration."

Arrest and ‘turning point’

Barati's relationship with Iran's security establishment appears to have changed dramatically in 2010.

After earlier run-ins with the judiciary over unrelated financial complaints, he was arrested following a complaint by the Khorasan Razavi office of the Intelligence Ministry.

Prosecutors accused him of hacking government websites, targeting the president's personal website, insulting the Supreme Leader and spreading propaganda against the Islamic Republic.

He spent only a short period in custody. Although he was sentenced to one year in prison on a propaganda charge, court records show the sentence was never enforced. The case reached the sentence-enforcement office in 2012 before being quietly closed little more than six weeks later.

From hacker to intelligence asset

Barati's brief imprisonment in 2010 appears to have marked a turning point—not the end of his hacking career, but the beginning of a different relationship with Iran's security establishment.

According to multiple sources interviewed by Iran International, the Intelligence Ministry chose to recruit him rather than prosecute him.

"These guys were recruited because they probably didn't have much of a choice," one cybersecurity expert familiar with Iranian hacking groups said. "The Intelligence Ministry—or, later, the IRGC Intelligence Organization—used them to target selected systems. If they refused to cooperate, their options were either prison or leaving Iran."

That account is supported by Masoud Molavi, a cyber activist with ties to senior officials who was himself arrested alongside Barati, Arman Kahzadian and another hacker in 2011.

Molavi had assembled a team of hackers with funding from Iran's Passive Defence Organization. Their stated mission was twofold: to carry out cyber operations against foreign targets while also identifying vulnerabilities in Iranian government systems and reporting them to officials. When the group was arrested, prosecutors accused its members of conspiring against national security by hacking government institutions and banks.

In his later account of the arrests, Molavi alleged that Kahzadian secured his release after agreeing to cooperate with the Intelligence Ministry. Barati, he claimed, was released later because he had effectively already become the ministry's informant inside the group.

A former acquaintance of Barati, who spoke to Iran International on condition of anonymity, said that process had begun even earlier, during his first arrest in 2010.

"Amir wasn't political at all," the acquaintance said. "The charges of propaganda against the Islamic Republic and insulting the Supreme Leader never made sense. He was arrested because of hacking. Once intelligence officials realised who they had, they recruited him."

According to the acquaintance, that decision fundamentally altered Barati's relationship with Iran's judicial system.

"That's why all the hacking charges disappeared and his one-year prison sentence was never enforced. After that, as long as he remained in Iran, he wasn't imprisoned again—even when private complainants filed cases against him. He had complete immunity."

Iran International could not independently verify those claims. But court records reviewed during this investigation show that Barati's only prison sentence was quietly abandoned despite reaching the enforcement stage, and that he continued to avoid incarceration despite later criminal complaints.

Meanwhile, neither of the hacking groups he had founded disappeared.

Digital Boys Underground and Iran Black Hats remained active for years after his alleged recruitment. Archived records show that the groups continued attacking Iranian and foreign targets alike, leaving behind the same distinctive digital signatures that had made them well known in cybersecurity circles.

Researchers say it remains unclear how many of those attacks involved little more than website defacement and how many led to data theft or extortion. But the volume of activity was substantial. Among the documented targets were Iran's National Educational Testing Organization and the Industries and Mines Organization of Hamedan Province, alongside hundreds of overseas institutions.

One cybersecurity expert said the groups often appeared less interested in causing visible disruption than in demonstrating they had penetrated a system.

"Apart from leaving the group's name, they usually published nothing," he said. "Sometimes they simply left a file in one of the site's directories."

The pattern of apparent judicial protection extended beyond Barati.

Between 2013 and 2019, Kahzadian was convicted at least four times on charges related to hacking and online fraud, receiving prison sentences totalling more than three-and-a-half years in addition to financial penalties. Yet Iran International found no evidence that he ever served those sentences.

While his legal troubles appeared to fade, Barati's lifestyle changed markedly.

After leaving his family home in Mashhad, he moved through a succession of increasingly affluent Tehran neighbourhoods, culminating in a luxury apartment in the Niavaran district. Friends and associates say the progression mirrored the growing wealth generated by his cyber activities.

In 2012, he joined the board of a private company whose activities ranged from computer services to conference organisation. Shortly afterwards, the company relocated its registered address to Barati's home in western Tehran. One source familiar with his affairs believes it served as a legal and financial cover for part of the income generated through his hacking activities. The company was dissolved in 2019, and its chief executive was later arrested on fraud and forgery charges.

For a period, Barati also worked from Bank Tejarat's technology centre on Tehran's Taleghani Street, apparently with the approval of the Intelligence Ministry.

His role, according to one cybersecurity expert, was to help secure the bank's computer network.

"But that job neither produced the money Amir dreamed of nor satisfied him," the expert said. "Eventually he left both the job and the country."

On March 23, 2021, Barati and his wife, photographer and Instagram influencer Mahnoosh Baghdarzadeh, relocated to Turkey.

Within months, he had purchased a two-bedroom apartment in Istanbul's Emaar Square Heights residential complex—a property that comparable listings suggest could have been worth close to $1 million once transaction costs and fittings were included. According to a source familiar with the purchase, it was paid for in cash.

The investment also opened the door to Turkish citizenship.

Soon after obtaining it, Barati and his wife successfully petitioned a Turkish court to change both their first and last names. Iran International was unable to determine the identities under which they later received Turkish passports.

The move appeared carefully calculated.

Turkey's constitution prohibits the extradition of Turkish citizens to foreign states, meaning Barati's new citizenship offered an important layer of protection even though Ankara and Washington have maintained an extradition treaty for decades.

Yet his behaviour suggests he never believed he was entirely beyond reach.

The Montenegro mistake

For five years after settling in Turkey, Barati appeared to live cautiously.

Although he had acquired Turkish citizenship and changed both his first and last names, sources familiar with his movements say he largely avoided travelling to Europe, limiting most overseas trips to Iran and the United Arab Emirates.

Eventually, however, he appears to have concluded that Montenegro posed little risk.

The small Balkan state is a NATO member but not part of the European Union, and it has no bilateral extradition treaty with the United States. Travelling under a different name and passport, Barati seems to have believed he could holiday there without attracting attention.

According to photographs later deleted from his wife's public Instagram account, the couple travelled to the Adriatic resort town of Kotor in late June for a summer holiday.

They remained there until June 25, when Barati was arrested.

The calculation proved mistaken.

Although Montenegro lacks a bilateral extradition treaty with Washington, it maintains close judicial and law-enforcement cooperation with the United States and other Western countries. Its courts have previously approved extraditions requested by US authorities, including the 2022 transfer of three people convicted of stealing more than $18 million in pandemic-relief funds.

Barati's case has now been referred to the High Court in Podgorica.

Montenegrin authorities say US prosecutors accuse him of participating since 2013 in a large-scale cyber campaign targeting more than 150 American universities and research institutions, as well as government-linked organisations and private companies holding sensitive information. According to the allegations, the attacks caused losses estimated at more than $3.4 billion.

Police also alleged that information obtained during the attacks—and access to compromised university accounts—was provided to the Islamic Revolutionary Guard Corps and other Iranian institutions. The FBI has not publicly commented on the details of the case.

A familiar pattern

The allegations bear striking similarities to one of the Justice Department's most significant cyber prosecutions against Iran.

In 2018, US prosecutors accused hackers working for the Mabna Institute of conducting a years-long campaign against 144 American universities and 176 institutions in 21 other countries. The targets also included government agencies, private companies, the United Nations and UNICEF.

Barati's name did not appear among the nine defendants identified in that indictment.

Yet several core elements of the allegations now presented in Montenegro closely mirror the Mabna case: the timeframe beginning in 2013, the focus on universities, the alleged transfer of stolen information to Iranian state institutions and the estimated losses of $3.4 billion.

Asked about Barati's case, a spokesperson for the US Justice Department declined to comment. The FBI, the US Attorney's Office in New York, Montenegro's prosecution service and Turkey's Justice Ministry also did not respond to questions from Iran International.

One further clue has emerged.

Iran Cyber News, a website that tracks Iranian cyber operations, has added Barati's arrest to its chronology of the Mabna Institute case and identifies him as a member of Silent Librarian—the name used by cybersecurity researchers to describe the university-targeting campaign attributed to Mabna.

Whether Barati was an undisclosed participant in that operation, a member of a parallel network, or the subject of a separate investigation remains unclear.

Those questions may not be answered until the case reaches a US courtroom.

But one conclusion is already difficult to escape.

According to court records, open-source evidence and interviews conducted by Iran International, Barati spent years building a reputation as one of Iran's most capable hackers before, according to multiple sources, becoming an asset of the country's intelligence apparatus. He then appears to have reinvented himself through a new country, a new citizenship and a new identity.

None of it proved enough.

If extradited, Barati will become one of the few alleged members of Iran's cyber apparatus to face trial in the United States after years of apparently evading investigators through a change of residence, nationality and name.