How Iran's 'hybrid attack' network could retaliate against Israel in Europe

Iran can call on networks of criminals and even its own agents smuggled into Europe as migrants to carry out retaliatory attacks against Israeli and Jewish targets, following Friday's strikes by Israel.

Tehran has previously relied on regional allies Hezbollah, the Houthis and Hamas to attack Israel. However, with what Tehran called its “ring of fire” degraded, it has other avenues further afield, particularly in Europe, to hit back against Israel.

These include criminals networks, most notably two based in Sweden run by Kurdish gangsters Rawa Majid and Ismail Abdo, that have been accused of carrying out attacks on Israeli targets.

LatestIran threatens 'large-scale attacks' on Israel as Katz warns 'Tehran will burn'

Read More

Majid, who is nicknamed the Kurdish Fox, and his Foxtrot network were placed under sanctions by the US and the UK this year for orchestrating an attack on the Israeli Embassy in Stockholm.

Three Iranian nationals were recently charged in the UK with a plot to attack an individual on behalf of Iran.

An official report released in Germany on Tuesday warned that the potential threat from Iran is growing. The findings, which summarised trends in 2024, said Iranian intelligence services can be assumed to be ready to “pursue the interests of the country's leadership by all means – including acts of violence and even assassinations”.

“The tense security situation in the Middle East and internal tensions within the Islamic Republic of Iran shape its intelligence activities,” the Ministry of Interior document said. “Activities directed against Germany continue to emanate primarily from the Ministry of Intelligence or MOIS. In addition to the MOIS, the Quds Force of the Iranian Revolutionary Guard Corps, which also operates as an intelligence agency, is also active in Germany.

“Intelligence services of the Islamic Republic of Iran also use state terrorist means to achieve their goals,” it added. “This primarily involves the intimidation and neutralisation of opposition members, but also the punishment of 'traitors' or 'defectors'.

“Iran's activities go well beyond spying on the opposition Iranian diaspora and that pro-Jewish and pro-Israeli interests and institutions in Germany are the focus of Iranian activities.”

Jason Brodsky, policy director of advocacy group United Against a Nuclear Iran, told The National that European nations need to be “extra vigilant and step up alerts” given that Iran “has long planned contingency plans for terror operations in the West”.

“That’s a risk that everyone should be alert for, especially Israel and the Jewish community, and Iran still retains that capability through the IRGC or its intelligence ministry,” Mr Brodsky said.

“They will also hire criminal networks to foment terror and undertake operations. And there are also Iranian dissidents that the regime targets. These are potential risks to look at and policymakers need to make it clear to Iran that any operations will be viewed as akin to an act of war.”

Speaking before Israel’s attack, the UK’s Foreign Secretary, David Lammy, announced the creation of a “counter-hybrid taskforce” aimed at combating the activities of states such as Iran.

Tehran has been developing hybrid warfare tactics including using cyberattacks, proxies and propaganda. Mr Lammy said Britain’s diplomats “will be ready for this murky new age of sabotage and subterfuge”.

Iranian actors and criminals working for them have been known to carry court surveillance and reconnaissance, with the intention of carrying out serious violence.

Announcing sanctions against Majid and his Foxtrot network, the US Treasury said Iran was “increasingly” using criminal networks as proxies so it could maintain plausible deniability for operations against its enemies.

“Iran’s brazen use of transnational criminal organisations and narcotics traffickers underscores the regime’s attempts to achieve its aims through any means, with no regard for the cost to communities across Europe,” said Treasury Secretary Scott Bessent.

Iran has sought to assassinate dissidents through other criminal networks, including that of Iranian drug trafficker Naji Ibrahim Sharifi-Zindashti, who had sanctions imposed on him by the US last January.

Known as “the Big Guy”, he allegedly organised the attempted murder for hire of two residents of the state of Maryland.

Tehran has also used foreign individuals, known in the spying trade as “disposable assets”, to harass opponents of the regime, including employees of Iran International, a London-based dissident television channel.

In December 2023, Magomed-Husejn Dovtaev, a Chechnya-born Austrian citizen was found guilty of spying on the broadcaster.

Iran International was forced to move to new high-security studios after being shut down following alleged threats from the Iranian state.

Two Romanian citizens were charged in December 2024 over the stabbing of Iran International journalist Pouria Zeraati.

Iran International spokesman Adam Baillie said: “We are watching developments closely and we remain as ever on high alert for the security implications.”