Statecraft or criminality? Iran’s covert operations and proxy networks in Europe

In May 2025, British police arrested four Iranian nationals as part of a counter-terrorism investigation, later charging three with espionage. Separately, five others were questioned over an alleged plot to attack the Israeli embassy in London. These incidents come amid growing concern among European security agencies over Iran’s expanding covert operations across the region. As part of a broader hybrid strategy, Tehran has frequently relied on unconventional methods – using grey-zone tactics, and increasingly, partnerships with organised crime groups – to project power and target adversaries in the West, particularly as its conventional military capabilities come under strain, as highlighted by Israel’s most recent airstrikes. This is part of Iran’s continued assertive posture aimed at advancing its strategic objectives in the West while avoiding the risks associated with direct confrontation.

Plausible deniability

Since its inception, the Islamic Republic has relied on extraterritorial tactics to suppress dissent and advance political objectives abroad, including the targeting of Iranian dissidents, diaspora communities, and Jewish or Israeli interests. While Iran has long used proxies like Hezbollah to extend its influence in the Middle East, recent years have seen a marked increase in its overseas operations – particularly in Europe. Between 2021 and 2024, over half of all known Iranian-linked plots occurred in European countries, with UK authorities launching 20 separate investigations since 2022. These activities have traditionally allowed Tehran to offset its conventional military disadvantages against more powerful adversaries such as the US and Israel by using non-state actors to carry out assassinations, surveillance, and acts of sabotage. In recent years, Iran has evolved this strategy by increasingly relying on organised crime networks, which has added a layer of plausible deniability, especially amid growing Western scrutiny of Iranian activities abroad. Tehran’s continued use of these tactics reflects its broader ambition to challenge the regional and global order and strengthen its position against the perceived dominance of the US, Europe, and Israel. This approach is likely to intensify as Iran’s strategic position has weakened following direct military exchanges with Israel in April 2024 and June 2025, which have exposed key vulnerabilities in its defences, the significant degradation of Hezbollah’s capabilities, and the recent ousting of Syrian President Bashar al-Assad – another key Iranian ally.

Tehran’s Footprint in Europe

Iran’s tactics in Europe have evolved into a sophisticated blend of statecraft and criminal outsourcing, echoing its use of proxy forces like Hezbollah in the Middle East. Rather than relying solely on its own operatives, Tehran systematically recruits local criminal networks – ranging from drug traffickers to street gangs – to advance its interests across the continent. Investigations by MI5 and various other Western intelligence agencies have shown that Iranian operatives, particularly within the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS), cultivate ties with European-based organised crime groups through middlemen. This approach shields Iranian operatives from direct exposure to European security services and grants access to resources and manpower that would be difficult to build independently. It is no coincidence that many of these operations have been concentrated in countries such as the Netherlands, Sweden, the UK, and Germany – states with a high concentration of Israeli interests, sizeable Iranian diaspora communities, but also a growing organised crime presence, which creates favourable conditions for Iranian operatives to forge ties with established and increasingly assertive criminal networks.

The groups are actively contracted to monitor and intimidate Iranian dissidents, as well as to target Jewish and Israeli-linked businesses, embassies, and community figures. For instance, Iranian agents have leveraged drug traffickers based in Iran to hire local criminals for surveillance operations in cities like Paris, Munich, and Berlin. Meanwhile, in Sweden, notorious gangs such as Foxtrot and Rumba have been implicated in grenade and shooting attacks on the Israeli embassy in Stockholm, with intelligence agencies confirming these acts were orchestrated at Iran’s behest. The transactional nature of these arrangements – sometimes involving payments as low as a few thousand euros – suggests that the proxies are often motivated by profit or status rather than ideology, allowing Iran to exploit the fluid loyalties and ambitions of Europe’s criminal underworld. Beyond the immediate security threat, these operations risk creating a climate of fear among European Jewish communities, destabilising the Iranian diaspora, and placing growing political pressure on European governments to respond. European agencies are stepping up intelligence sharing and joint operations, but the diffuse and transactional nature of these networks makes disruption an ongoing challenge.

Looking ahead

As airstrikes between Israel and Iran intensify and regional tensions escalate, Iran may lean increasingly on covert activities to target adversaries. With its conventional options for targeting Israeli interests proving limited and often ineffective over the past year, Iran is likely to double down on its reliance on criminal networks to project power and intimidate adversaries on European soil. The adaptability and deniability afforded by these proxies make them an attractive tool for the regime, especially as organised crime continues to be an issue in key European countries. As a result, European security agencies should expect these tactics not only to continue but potentially escalate, presenting ongoing challenges for law enforcement and intelligence services tasked with protecting vulnerable communities and countering Tehran’s shadowy influence.