Iranian hacker awaits extradition from Montenegro to the US

Montenegro has initiated extradition proceedings against Amir Barati, who is accused by the United States of participating in massive cyberattacks on critical infrastructure that caused more than $3.4 billion in damage to the Iranian Revolutionary Guard Corps (IRGC).

According to police, the arrest was made in cooperation with the US Federal Bureau of Investigation (FBI), and the US is accusing Barati of participating in hacker attacks on at least 150 American universities, as well as stealing confidential data and intellectual property.

Barati was handed over to the High Court in Podgorica, which, according to the procedure, ordered that he be held in custody pending extradition, after which extradition proceedings against him will begin, which could take months.

The name of Amir Barati, who according to police has Iranian and Turkish citizenship, was not explicitly mentioned in previously published US cybercrime indictments.

The American legal system has often used "sealed" indictments filed subsequently in similar cases, which are only opened after the person is arrested, which allows the US to maintain "fugitive from justice" status for a long time.

The charges published by the Montenegrin police contain the same elements as the 2018 case in the US against the so-called "Mabna Group".

Tehran's Mabna Institute and nine Iranians are accused of attacking more than 320 universities around the world, including about 144 in the United States, on behalf of the Iranian Revolutionary Guard Corps (IRGC).

The indictment published against the "Mabna Group" also states that $3.4 billion in damages were caused.

In the hacking attacks by the Mabna Group, approximately 8,000 user accounts of professors, researchers, and employees were compromised and approximately 30 terabytes (30 thousand gigabytes) of academic research and scientific papers were stolen.

None of the nine Iranian nationals accused have been arrested and convicted, and US prosecutors say they are beyond the reach of justice.

How did Barat come to Montenegro?

The Montenegrin police did not respond to REL's question as to whether the identity of the arrested person had been determined, whether he had resided in Montenegro under that name or under another name, or whether he had been arrested upon arrival or while traveling to other countries.

There is also no answer to the question of whether the arrested person is suspected of an attack on IT infrastructure in Montenegro, which is a NATO member.

Security and judicial experts have warned for years that the Western Balkans has always been interesting for organized crime groups, due to its geographical location between Europe, the Middle East and Asia, visa-free regimes with countries like Russia or China, different extradition standards, but also a sufficiently developed digital infrastructure.

Adis Balota from the Faculty of Information Technologies in Podgorica recalls that this is not the first case and that in the wider region in recent years numerous members of hacker groups that infiltrate through migration flows have been identified, and he says that those working for the benefit of states have "practically unlimited resources."

"Such attacks are not only for financial gain. We also have military or industrial espionage. Cyber ​​threats have no borders and such groups can attack critical infrastructure in any country in the world from the Western Balkans," said Balota.

Iran and the IRGC have a long history of cyber operations directed against the US and other Western countries.

Iran is present in countries in the region through embassies, cultural and educational centers, and groups affiliated with Iran have attacked critical infrastructure in countries in the region, including an attack on government institutions in Albania, which shelters the Iranian dissident opposition.

US cyber and intelligence agencies warned in April of "increasing Iranian operations targeting critical infrastructure systems, including energy, communications and educational networks", adding that such campaigns had intensified in recent months.

In countries in the region, members of various organized criminal networks that traffic drugs, weapons and people, launder money or are high-ranking members of terrorist networks, such as the so-called Islamic State of Syria and Iraq, have been largely discovered and arrested.

What awaits Barati in Montenegro?

The law firm Lutovac & Partners from Podgorica explained to Radio Free Europe/Radio Liberty that after an arrest based on an international arrest warrant, the suspect is brought before an investigating judge who determines the identity and records a short statement on the arrest warrant.

After that, detention for extradition is usually ordered.

Under a new law passed in 2026, detention can last until a final extradition decision, whereas previously it was limited in time.

The country requesting extradition, in this case the US, has 40 days to file a formal extradition request, otherwise the detention will be lifted, although, according to lawyer Vuk Lutovac, such outcomes rarely occur in practice.

The requesting country forwards the documentation through diplomatic channels to the Ministry of Justice of Montenegro, the Ministry forwards it to the court, and the court forwards it to the defense attorney. The court then schedules a hearing to consider the conditions for extradition, including nationality, whether there are risks of political, religious or racial persecution, human rights violations or imposition of the death penalty.

In the first case, a panel of three judges makes the decision, following the opinion of the investigating judge, after which the case is sent ex officio to the Court of Appeal. If the court concludes that there are no conditions for extradition, the person is released, otherwise the proceedings can continue through an appeal procedure.

The final decision, after the court decision becomes final, is made by the Minister of Justice of Montenegro.

An asylum application can be filed in parallel with the extradition procedure, which postpones extradition until a decision on international protection is made. If asylum is granted, extradition is not carried out.

A constitutional complaint may be filed against the decisions of the Court of Appeal to the Constitutional Court of Montenegro, which does not formally suspend the execution of the extradition. However, according to legal practice, in certain cases the Constitutional Court urgently examines such complaints and temporarily postpones the extradition in order to avoid the loss of legal protection.

Can Montenegro extradite Barati to the US?

Montenegro and the US do not have a formal bilateral extradition treaty.

In recent years, the two countries have developed a practice of cooperation in extraditions, including several cases in which individuals accused in the US were handed over to American justice.

One of the most recent examples is the extradition of South Korean citizen Do Kwon, who was arrested in Montenegro in March 2023 and extradited to the US in December 2024, after numerous court decisions and a final decision by the new Minister of Justice.

A similar pattern has been observed in previous cases of extradition of US citizens, such as the case of Richard and Marietta Ayvazyan, who were extradited to the US in late 2022, where they were convicted of fraud, embezzlement, and money laundering worth over $20 million.