Date first published: 29/05/2025
Key sectors: all
Key risks: political violence; gang violence; targeted attacks
Risk development
On 4 May eight people – including seven Iranian nationals – were arrested in the United Kingdom (UK) during major counter-terrorism operations on suspicion of plotting “terrorist” acts and posing a threat to national security. On 17 May three of the suspects – who had entered the UK as asylum seekers years earlier – were charged in London with assisting Iran’s intelligence services in a plot to target UK-based journalists critical of Tehran. Five of the other suspects were investigated for planning an attack on an unspecified site in London, with police bolstering security at the location. The UK’s MI5 disclosed that it had responded to at least 20 potentially lethal Iranian-backed plots since January 2022.
Why it matters
The arrests came amid intensified scrutiny of covert Iranian operations, which have been intensifying across Europe as Iran leverages local criminal networks to extend its reach on foreign soil. These operations range from assassination plots and surveillance of dissidents to attacks on Jewish and Israeli targets. Domestic security services have been forced to divert significant resources to foiling Iranian plots on their soil. Iran’s use of criminal gangs, foreign recruits and underage youths – often involving drug-trafficking groups – has led to a shift from traditional espionage to hybrid proxy operations, deliberately blurring the lines to overwhelm Western security services. By exploiting the “grey zone” between international and domestic law, these hybrid operations complicate investigations by making many probes collapse into standard domestic criminal proceedings in the absence of direct links to state actors.
Background
Analysts tracking patterns of attacks have noted that after a foiled 2018 bomb plot against an Iranian opposition rally in France – which led to the conviction of an Iranian diplomat for his role in the plot – Tehran shifted tactics to rely more on criminal networks as proxies. Such attacks have seen a notable rise since the outbreak of the Israel-Gaza war in October 2023, which has fuelled tensions between Jewish and Muslim communities, as well as between Iran and Israel. On 30 January an Iraqi refugee and anti-Islam campaigner, Salwan Momika, was killed in a shooting by an unidentified assailant in Sodertalje, near Stockholm. The attack came hours before a trial verdict was due over Momika’s public burning of the Quran at a series of protests he organised in 2023, which sparked outrage among Muslim communities and Muslim-majority countries. Swedish authorities hinted that Iran – which called for those who desecrate the Quran to be severely punished – may have been behind the attack.
Separately, in March the United States (US) sanctioned Sweden’s transnational drug-trafficking network Foxtrot for serving as a proxy of the Iranian regime, accusing the group of carrying out an attempted IED attack on the Israeli Embassy in Stockholm in January 2025. There have been several similar incidents of gunfire and explosions over the last two years. In May 2024 Swedish authorities arrested two 14 and 15-year-old boys after a shooting incident near the Israeli Embassy in Stockholm. On 2 October 2024 three Swedish nationals were arrested after a grenade was thrown at the Israeli Embassy in Copenhagen, Denmark. On the same day, shots were fired outside the Israeli Embassy in Stockholm. On 10 October 2024 a 13-year-old boy was also arrested in connection with a shooting at Israeli defence firm Elbit Systems’ unit in Gothenburg, Sweden. Police attributed several of the incidents to Iranian-linked criminal networks, which often recruit underage minors to exploit the lenient penal system for juvenile criminals.
Risk outlook
In response to Iran’s hybrid operations, European security forces are adapting new laws and tools to recalibrate counter-terrorism responses, such as the UK’s National Security Act 2023 and enhanced foreign agent registration requirements. Iranian opposition activists will remain prime targets, along with Jewish and Israeli communities and sites – including commercial assets linked to Israeli firms – prompting police to tighten security around potential targets. Iran’s state-sponsored clandestine activities in Europe are likely to persist or even increase in the near term, testing European security services’ ability to counter such hybrid operations.