Montenegro Police, FBI Detain Iranian Hacker Suspected of $3.4 Billion U.S. Cyber Attacks

BELGRADE — Montenegrin authorities, in coordination with the U.S. Federal Bureau of Investigation, have arrested a 39-year-old Iranian man accused of leading a series of devastating cyberattacks that inflicted an estimated $3.4 billion in damage to American infrastructure, officials confirmed Thursday.

The suspect, who holds dual Iranian and Turkish citizenship, is wanted by the U.S. Southern District Court of New York on charges of conspiracy to commit computer fraud, aggravated hacking, and identity theft. He was taken into custody in the coastal resort town of Kotor, a popular Adriatic destination, according to Montenegro's police directorate.

According to a police statement, the individual conducted “massive hacking operations” beginning in 2013, targeting more than 150 universities across the United States. The stolen data and unauthorized access to university systems were later leveraged to benefit Iran’s Islamic Revolutionary Guard Corps (IRGC) and other Iranian-linked entities, including academic institutions within Iran.

The case now moves to a High Court judge in Podgorica, Montenegro’s capital, where extradition proceedings will be initiated. The FBI declined immediate comment on the arrest.

This operation highlights the persistent cyber threat posed by Iran, particularly the IRGC, which has a long track record of state-sponsored hacking campaigns aimed at the United States. In April, multiple U.S. agencies—including cybersecurity, law enforcement, and intelligence bodies—issued a joint warning about an increase in Iranian cyberattacks targeting critical infrastructure systems, from energy grids to water utilities.

The arrest marks one of the largest collaborative takedowns between Balkan law enforcement and the FBI in recent years, underscoring the global reach of Iranian cyber operations and the growing international effort to counter them.