The Iranian Problem Washington Left in Albania

How a decision made in Washington placed a small NATO ally on the front line of Iran’s cyber war.

by Elis Cali (Michigan, USA)

Iran hit the Albanian Parliament on March 10. Not with a missile, but with something that has become, over the past decade, almost as reliable: a cyberattack attributed to the IRGC-linked group Homeland Justice. The group claimed to have seized control of the Assembly’s servers and published hundreds of megabytes of internal parliamentary correspondence on Telegram. Albania’s Security Council was convened. Independent cybersecurity experts reviewing footage the hackers released themselves said the intruders had moved freely through the parliamentary network, deleting virtual machines and accessing server infrastructure. Parliament said its main systems were unaffected. The experts said otherwise.

Three days later, Prime Minister Edi Rama announced that parliament would vote the following week to declare Iran a state sponsor of terrorism, the Islamic Revolutionary Guard Corps a terrorist organization, and Hezbollah its proxy.

The proximity was not coincidental. It reflected the logic of a relationship that has been intensifying for more than a decade — one that American readers in particular have reason to understand, because the story begins in Washington.

In 2013, the United States asked Albania for a favor. The Mojahedin-e-Khalq — the MEK, Iran’s largest organized opposition movement — needed a country willing to take them in. They had been based in Iraq since the 1980s; Baghdad wanted them gone. The United States had brokered their protection, vouched for their renunciation of violence, and removed them from the U.S. list of foreign terrorist organizations in 2012. What remained was the question of where roughly three thousand people would live.

Albania, a NATO member since 2009 and eager to demonstrate its reliability as an ally, said yes.

Beginning in 2016, MEK members were transferred to a fortified compound called Ashraf-3, built on farmland near Manëz, between Tirana and Durrës. From Washington’s perspective, the problem was solved: a vulnerable opposition movement preserved and a dependable ally demonstrating its value to the alliance. From Tehran’s perspective, it looked very different — an enemy installation thirty kilometers from Albania’s capital, housing the people the Iranian regime most wants to destroy, operating under Western protection and hosting annual political summits attended by senior American and European officials.

MEK leader Maryam Rajavi has since announced the formation of what she describes as a provisional government intended to replace Iran’s leadership entirely.

Albania accepted the MEK because Washington asked. It has been paying for that decision ever since.

The escalation that followed was methodical. In 2018, Albania expelled the Iranian ambassador and the station chief of the Ministry of Intelligence for activities deemed incompatible with diplomatic status. In 2020, two additional Iranian diplomats were declared persona non grata. In July 2022, Iran moved from espionage to destruction. Homeland Justice — later attributed to the IRGC by the FBI, the U.S. Cybersecurity and Infrastructure Security Agency, Mandiant, and Microsoft — launched a ransomware and data-wiping attack against Albanian government infrastructure after maintaining undetected access to its networks for approximately fourteen months.

That September, Rama severed diplomatic relations with Iran, making Albania the first country in history to cut diplomatic ties over a cyberattack. Washington condemned the operation as “reckless and irresponsible.” NATO issued a statement of solidarity. Neither deterred what came next: a follow-on attack weeks later, a strike on the municipality of Tirana in 2025, and now the breach of the Albanian Parliament in March 2026.

Albania, a country of just under three million people, now finds itself in a sustained cyber confrontation with a state of nearly ninety million.

The week of March 10 compressed years of accumulated pressure into a few days. On February 28, the United States and Israel struck targets across Iran, killing Supreme Leader Ali Khamenei. Albania publicly supported the strikes. Iran responded across the region with drones and ballistic missiles, targeting U.S. bases and Gulf states and sending several projectiles into Turkish airspace.

NATO defenses intercepted three Iranian ballistic missiles over Turkey in the span of nine days: March 4 in Hatay province, March 9 over Gaziantep, and March 13 over the eastern Mediterranean. Each time, Iran described the incidents as technical anomalies. Each time, Ankara summoned the Iranian ambassador. President Recep Tayyip Erdoğan issued a direct warning to Tehran to cease what he called “wrong and provocative steps.”

Rama condemned each incident, describing Turkey as “a brotherly country, a strategic partner, and a valued NATO ally,” and calling Iran’s conduct “extremely dangerous.” The language was not routine diplomatic phrasing. Albania and Turkey share a particular solidarity inside NATO, and the spectacle of Iranian ballistic missiles entering Turkish airspace carried a meaning in Tirana that it did not carry in quite the same way in Brussels or Washington.

During that same week, Homeland Justice returned.

The group published excerpts of the parliamentary documents alongside a message addressed directly to Albania: Did you really shelter those murderers and child killers? We will make sure that this shame stays with you forever.

The reference to Ashraf-3 required no explanation. Neither did the timing.

As Albania publicly condemned Iran’s regional conduct and prepared a parliamentary resolution against the Iranian regime, Tehran’s cyber proxies delivered a reminder of the conflict already under way.

The resolution filed by Interior Minister Taulant Balla on behalf of the Socialist parliamentary group aligns Albania formally with the U.S. designation of the IRGC in 2019 and the European Union’s designation of the organization in January 2026. It goes further than the EU position on Hezbollah, designating the organization in its entirety rather than only its military wing, and it declares Iran itself a state sponsor of terrorism — language without direct domestic legal consequences but with considerable political weight directed at allies, the United Nations, and Brussels.

It was in announcing this resolution that Rama made his most deliberate rhetorical move. He refused, publicly and repeatedly, to refer to Iran as the Islamic Republic. Instead, he called it the Khomeinist Republic — a formulation that strips the regime of its claim to represent Islam and frames it instead as the political project of a single revolutionary ideology.

The choice of words was not accidental. It was an argument compressed into a noun, addressed to a country whose population is majority Muslim and to an international audience equally aware of the distinction.

There is something worth considering in Washington as Albania’s parliament prepares to vote. Albania accepted the MEK because the United States asked it to and because it understood that reliability to be the price — and the proof — of genuine alliance membership. It has absorbed the diplomatic rupture with Iran, the intelligence operations, the cyberattacks, the permanent threat directed at a compound on its own territory, and now a breach of its parliament itself.

The United States coordinated the decision that placed three thousand Iranian dissidents outside Tirana. The consequences of that decision have been borne almost entirely by Albania. The structure of that arrangement has not been meaningfully revisited in more than a decade, even as the threat it created has grown with each passing year and now sits within a regional conflict Albania did not initiate and cannot control.

Homeland Justice promised that the shame would last forever. Albania’s parliamentary resolution suggests Tirana has made a different calculation — that visibility has strategic value when deterrence fails, and that being formally, publicly on record is one of the few instruments available to a small country when a larger adversary has decided, partly because of someone else’s foreign policy, that it will not leave you alone.