Montenegrin police and the FBI have arrested an Iranian national wanted by the United States over a major hacking campaign that allegedly targeted US universities and benefited Iran’s Revolutionary Guards, Reuters reported.
The 39-year-old man, who holds Iranian and Turkish citizenship, was identified by Montenegrin media as Amir Barati and was arrested in the Adriatic resort town of Kotor, Montenegro’s police directorate said Thursday.
He is wanted by the US District Court for the Southern District of New York on charges including conspiracy to commit computer fraud, hacking and identity theft. The case will now go before a High Court judge in Podgorica for extradition proceedings.
Montenegrin police said the suspect had carried out large-scale cyberattacks from 2013 onward, targeting more than 150 universities in the United States and causing damage estimated at more than $3.4 billion.
Police said the stolen data and access to compromised university accounts were used for the benefit of the Islamic Revolutionary Guard Corps and other Iranian entities, including universities.
Barati’s name does not appear on the FBI’s public list of nine Iranian hackers charged in 2018 over the Mabna Institute campaign, but the allegations described by Montenegrin police closely match that case, including the 2013 start date, the university targets, the IRGC connection and the $3.4 billion damage estimate.
The overlap leaves open the possibility that Barati was tied to the same broader operation or to a related US case, though neither US nor Montenegrin authorities have publicly linked him to the 2018 indictment.
The FBI said in 2018 that the Mabna Institute, an Iran-based company created in 2013, was used to steal access to non-Iranian academic and scientific resources through computer intrusions. US authorities said members of the institute were contracted by the IRGC and other Iranian government clients.
According to the FBI, the campaign compromised about 144 US-based universities and 176 foreign universities in 21 countries. It also targeted private companies, US government entities, the states of Hawaii and Indiana, and the United Nations.
US authorities said the hackers targeted more than 100,000 professor accounts worldwide and successfully compromised about 8,000 of them. They stole more than 30 terabytes of academic data and intellectual property, including journal access, research papers, electronic books and other proprietary academic material.
The campaign relied heavily on spearphishing emails that appeared to come from other academics. Victims were directed to fake university login pages, where their credentials were captured and later used to access library databases and research platforms.
The FBI said the stolen material covered a wide range of fields, including science, technology, engineering, medicine, social sciences and other academic disciplines.
US investigators also said the hackers used password-spraying attacks against companies and government targets, gaining access to email accounts and sensitive data. Victims included academic publishers, media and entertainment companies, technology firms and investment firms.
When the 2018 charges were announced, then-FBI Deputy Director David Bowdich said apprehending the suspects would be difficult but “not impossible,” adding that the defendants could be arrested if they traveled outside Iran.
“Where we can’t apprehend these individuals quickly, we will resort to different methods – naming and shaming, sanctions, and a lot of publicity,” Bowdich said at the time. “We will keep at it, because the FBI and our partners at the Department of Justice have a very long memory.”
The arrest in Montenegro suggests that warning may now be playing out years later, as one suspect allegedly linked to the campaign faces possible extradition to the United States.
The case comes amid renewed US warnings about Iranian cyber operations. In April, US cybersecurity, law enforcement and intelligence agencies warned of escalating Iranian hacking campaigns targeting equipment across critical infrastructure.
Ryu Hyun-woo, a former acting ambassador at North Korea’s embassy in Kuwait, made the remarks in an interview published this month by the Korea Development Institute, a prominent South Korean think tank.
“North Korea provided Iran with tunnel design and technology in the early 2000s, receiving about $25 million,” Ryu said.
“I understand that North Korean tunnel technology was applied to a considerable extent at underground nuclear facilities in areas such as Natanz and Isfahan,” he added.
Possible transfer to Hezbollah and Hamas
Ryu said reports of direct North Korean links to Hezbollah and Hamas were inaccurate.
“Many media outlets talk about North Korea-Hezbollah and North Korea-Hamas links, but that is not true,” he said.
He said North Korea was unlikely to have directly transferred tunnel expertise to either group, but added: “It cannot be ruled out that Iran transferred tunnel-related technology it received from North Korea to Hezbollah or Hamas.”
Earlier reporting
The comments follow a March report by The Washington Times, which said North Korean entities had supplied Iran with underground construction expertise and missile technology.
The newspaper cited Bruce Bechtol, a former US Marine and political science professor at Angelo State University, as saying North Koreans helped build underground facilities in Iran, including at Isfahan, in the early 2000s.
“Most of Iran’s underground facilities – including Isfahan – were built in the early 2000s by North Koreans,” Bechtol told the newspaper.
Bechtol said North Korea’s support also included missile systems, help with arms-factory construction, specialized components and technical personnel. Iran and North Korea have not publicly confirmed the reported transfers.
"Neither have we had a meeting with the director general of the IAEA, nor is there a plan for agency inspections of Iran's damaged nuclear facilities," Iranian Foreign Ministry spokesperson Esmail Baghai told a news conference.
"There is no protocol for this issue," he said.
Vance said on Monday that talks in Switzerland between US and Iranian officials had laid a "very good foundation" for a final agreement to end the war.
Asked when International Atomic Energy Agency inspectors could return, he said the process would start "at a minimum this week" and that conversations with the agency "could happen as soon as today."
President Donald Trump said on Monday that Iran "will agree to have Major Weapons Inspections."
Iran suspended IAEA access to sites hit during last summer’s 12-day war. The UN nuclear watchdog later withdrew its remaining inspectors from the country.
Frozen funds and US farm sales
Baghaei also rejected the idea that Iran had agreed to use frozen funds to buy US agricultural goods, after Vance said the issue had come up in the talks.
Vance said the US had asked Qatar to help set up a mechanism to direct the money.
"We could ensure that the money goes where we want it to go," Vance said. "That will obviously be a big part of the negotiation in the days to come."
He said the arrangement would help "American farmers" and the people of Iran, but added that the funds would not be released unless Washington saw further progress.
Baghaei said Iran would decide how to use its assets based on national interests and needs.
"Any decision will be made based on the interests and welfare of the country," he said.
He said Iran’s agriculture ministry and other bodies would decide on purchases based on price and quality.
Missiles outside talks
Baghaei said Iran’s missile and defense capabilities were not part of the negotiations and would not be discussed.
"Iran's defensive and missile capabilities have absolutely not been part of our talks and will never be a subject of negotiation with any party," he said.
He said Iran and the US had no direct contact after the four-party meeting in Switzerland stopped, and that messages continued through mediators Qatar and Pakistan.
"After the decision to stop the four-party negotiations, we had no direct contact with the American side," Baghaei said.
He said the sides had not held detailed talks on nuclear issues in Switzerland.
"Apart from the general presentation of positions by the American side, no detailed discussion on the nuclear issue took place," he said.
Oil waiver
The US Treasury on Monday issued a 60-day license allowing Iran to produce, sell and deliver crude oil and petrochemicals, with related banking, insurance and transport services.
Baghaei said the oil-sale authorization had taken effect and Iran could use released or previously blocked assets to buy goods it needed.
"What is important for us is access to assets that have been unjustly blocked," he said.
Treasury Secretary Scott Bessent said the waiver was linked to Iranian commitments to keep the Strait of Hormuz open and allow IAEA inspectors back into the country.
Lebanon mechanism
Baghai said Iran, the US, Qatar, Pakistan and Lebanon had agreed in principle to a mechanism to oversee the ceasefire in Lebanon and prevent further clashes.
"The details of this mechanism require further examination and work," he said.
Iranian Foreign Minister Abbas Araghchi has said Lebanon would be the first "real test" of the agreement.
