Two separate transatlantic law-enforcement actions this week have led to the arrest of prominent cybercriminal suspects on European soil, marking a rare simultaneous disruption of both state-aligned and hacktivist networks. Montenegrin police, working with the FBI, detained a 39-year-old Iranian-Turkish dual national in the Adriatic resort of Kotor, while Spanish National Police, acting on intelligence from Argentina’s Federal Police, raided a residence in Rivas-Vaciamadrid, near Madrid, and seized devices linked to the alias “@Gov.eth”. Both suspects now face extradition proceedings that will test the speed of judicial cooperation between the host countries and the requesting states.

The man held in Montenegro is accused of orchestrating, since 2013, a sustained hacking campaign against more than 150 American universities. According to the Montenegrin police statement, the intrusions caused financial losses exceeding $3.4 billion. A Southern District of New York indictment charges him with conspiracy to commit computer fraud, hacking, and identity theft. The same statement asserts that data exfiltrated from compromised university accounts was funnelled to Iran’s Islamic Revolutionary Guard Corps and other Iranian entities, including universities. Viewed from Washington, the arrest reinforces longstanding US intelligence assessments that Tehran systematically harvests Western academic and research data through cyber operations. The FBI has not yet commented on the detention.

The parallel operation in Spain originated from a Buenos Aires-led investigation into a series of breaches of Argentine public bodies. The suspect, identified by the initials M.E.T.P., is alleged to have attacked the National Registry of Persons (RENAPER), the national automobile registry, and media outlets. In April 2025, the actor published images of President Javier Milei’s national identity document on the website of the Perfil newspaper. Argentine federal investigators, using special investigative techniques authorised under Law 27.319, traced the online alias to a physical address in Madrid and shared the dossier with Spanish cybercrime units. The raid yielded mobile phones and computers that investigators believe contain direct evidence of the intrusions and possible links to wider cibercriminal communities. The case forms part of a larger Argentine probe, code-named “DICTADORES”, which has already led to 21 searches and 11 arrests.

The immediate next steps are procedural. In Montenegro, the case has been referred to a High Court judge in Podgorica to commence the extradition review. In Spain, forensic examination of the seized hardware will determine the full scope of the breaches and whether the suspect operated alone or as part of a structured group. Both processes will be closely watched by allied cyber-defence agencies for any intelligence on overlapping infrastructure or tactics.