Montenegrin police and the U.S. Federal Bureau of Investigation (FBI) arrested a 39-year-old Iranian national Thursday on charges tied to a hacking campaign that allegedly caused more than $3.4 billion in damage to U.S. infrastructure, Montenegro’s police directorate announced.
The suspect, identified by Montenegrin media as Amir Barati, holds dual Iranian and Turkish citizenship and was detained in the Adriatic resort town of Kotor. He is wanted by the U.S. District Court for the Southern District of New York on charges including conspiracy to commit computer fraud, hacking, identity theft, and organized crime.
Montenegro’s police directorate stated that from 2013, the suspect operated as an associate of an Iranian legal entity and carried out attacks targeting more than 150 U.S. universities. The stolen data and access to compromised university accounts were used for the benefit of Iran’s Islamic Revolutionary Guard Corps (IRGC) and other Iranian entities, including universities based in Iran, police said. The FBI did not immediately comment.
The case will go before a High Court judge in Podgorica for extradition proceedings. Montenegro is a NATO member and EU candidate state.
The arrest follows a documented escalation in Iranian cyber activity targeting U.S. systems. A joint advisory issued April 7, 2026 by the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Environmental Protection Agency (EPA), the Department of Energy, and U.S. Cyber Command warned that Iran-affiliated advanced persistent threat (APT) actors were actively targeting programmable logic controllers (PLCs) at U.S. energy and water facilities, causing operational disruptions across multiple critical infrastructure sectors.
In 2018, the U.S. Department of Justice indicted nine Iranian nationals affiliated with the Mabna Institute on similar charges of hacking U.S. universities from 2013 onward.
While Barati’s name does not appear on the original 2018 indictment of the nine Mabna hackers, the financial damage figures, dates, and university targets cited by Montenegrin police perfectly mirror the parameters of that federal case.
