Adversary Intelligence — 2026-07-02

Iranian Hacker Arrested in Montenegro for IRGC-Directed Economic Espionage Against 150 US Universities

BLUFArresting one operator will not disrupt what appears to be a decade-long IRGC academic theft network, and extradition to US custody is very unlikely by January 2, 2027.

Montenegrin police, working with the FBI, arrested a 39-year-old Iranian-Turkish national in Kotor last week; authorities named him only as A.B., though Turkish media identified him as Amir Barati 12. A New York court has charged him with computer fraud, hacking, identity theft and organized crime 1. Police allege hacking attacks dating to 2013 targeted US infrastructure, including more than 150 universities, and caused an estimated $3.4 billion in damage benefiting Iran's Islamic Revolutionary Guard Corps and other Iranian recipients 1, though authorities have not disclosed how the figure was calculated 2. He is due before a Podgorica court on the US extradition request 1. US authorities have not said whether the case connects to a 2018 federal indictment that charged nine other Iranian nationals in a similar university-hacking campaign 12.

Analysis
Montenegro's extradition process is very unlikely to reach a final Podgorica court ruling by January 2, 2027, given the multi-stage appeals typical of Balkan cases and the defendant's incentive to contest transfer absent an Iran-US treaty. Moderate confidence reflects reliance on a single detailed police account, with no public New York indictment yet anchoring the charges or timeline, and wire and analytical outlets adding framing rather than independent confirmation of the damage figure or identity. The case suggests Iran has extended its hacking playbook from infrastructure disruption into sustained IP theft for IRGC-linked recipients, echoing China's economic-espionage model, though the arrest may simply reflect Montenegro executing a years-old US request rather than any recent escalation, since the underlying conduct dates to 2013. Universities and prosecutors gain access to IRGC tasking and stolen-research pathways only if extradition succeeds; a blocked transfer leaves the 150 targeted institutions without confirmation of what was taken.

3 sources

Montenegro police arrest Iranian accused of hacking US universities - Euronews
Arrest of Iranian Hacker Spotlights Iran's Movement into Economic Espionage and IP Theft - Zero Day
Kotor: Uhapšen pripadnik Iranske revolucionarne garde, hakerskim napadima oštetio SAD za 3,4 milijarde dolara - RTCG (Radio Televizija Crne Gore)