Iranian Foreign Operations in Europe: The Criminal Connection | International Counterterrorism Center

In his latest update on national security threats against the UK, MI5 Director General Ken McCallum revealed that authorities have been dealing with twenty Iranian-backed attacks against British citizens and residents since January 2022. In these attacks, he added, “Iranian state actors are extensively using criminals as proxies – from international drug traffickers to low-level crooks.” In fact, this is a trend seen across Europe.

In September, investigators in Germany and France recently revealed that Iranian agents – operating through European drug traffickers based in Iran – had in recent months hired European criminals to monitor Jews and Jewish businesses in Paris, Munich and Berlin. After his arrest, a French criminal admitted that he had received €1,000 for photographing a target’s home in Munich in April. According to the French domestic intelligence agency DGSI, “Iranian services have adapted their approach and are now more systematically preferring to use people from criminal circles” for their attacks abroad.

Based on a data set developed by one of the authors (Levitt), the trend analysis clearly shows that after a foiled Iranian bombing in 2018 outside Paris led to the arrest and conviction of an Iranian diplomat for his involvement in the attack, Iranian operational commanders, particularly IRGC and MOIS, criminal networks are increasingly being used as proxies for attacks abroad in order to create distance between Tehran and operations abroad. The Washington Institute has created an interactive map based on this data set that depicts Iranian external operations – assassinations, kidnappings, intimidation and surveillance attacks – around the world and shows a significant increase in Iranian operational activity in Europe, with criminals involved in many of these attacks Recruits are involved.

Background: Recent Iranian operations in Europe using criminals

Shortly after Iran’s Islamic Revolution in 1979, Iran’s revolutionary leadership launched a campaign to assassinate Iranian dissidents and former Iranian officials who served under the Shah’s regime. Over the past 45 years, Iranian agents have continued to engage in assassinations, kidnappings, intimidation and surveillance plots against regime opponents around the world. Many of these attacks occurred in Europe, from the assassination of the Shah’s nephew, Shahriar Shafiq, in Paris in December 1979 to the knife attack on Iranian journalist Pouria Zeraati in London in March 2024.

Based on the author’s dataset on Iranian external operations presented in the interactive map and timeline of Iran’s external operations, of the 218 attacks in the overall dataset from 1979 to the present, 102 attacks occurred in Europe. The pace of Iranian operational activity in Europe has increased, with more than half of these attacks (54 cases) occurring between 2021 and 2024. These operations focused on Iranian dissidents (34 cases), including journalists who broadcast news in Farsi that Tehran would prefer not to see the light of day, Israeli citizens and diplomats (10 cases), and Jews (7 cases). Additionally, sixteen of these 54 attacks involved the use of criminal perpetrators to carry out the attacks. Six of these cases were against Iranian dissidents or journalists, seven against Israeli diplomats or embassies and four against Jews or Jewish institutions.

Consider the failed plan to assassinate two Iran International newscasters in London, dubbed “the wedding” by Iranian intelligence. The Iranian Revolutionary Guards (IRGC) hired a human smuggler (referred to as “Ismail” in subsequent investigations for his own safety) to assassinate Fardad Farahzad (the “groom”) and former presenter Sima Sabet (“the bride”) designated as targets by IRGC Unit 840 in November 2022. Ismail began working with Iranian intelligence in 2016 and was recruited for his role as a transnational criminal based in Europe.

How criminals are used in Europe

Iranian government officials are increasingly using drug traffickers and other criminals in Iran as intermediaries to recruit criminals for attacks abroad. Take the case of Umit B., a drug trafficker from the Lyon region of France with Turkish roots who is now reportedly operating from Iran. “According to Western secret services,” reports Spiegel, “he is allowed to hide in the country from the reach of European investigators, in return he helps the regime plan attacks against Jews and Israelis.” This corresponds to the case of Naji Ibrahim Zindashti, who is described by the U.S. Treasury Department as an “Iran-based drug trafficker” whose criminal network “has carried out numerous cross-border acts of repression, including murders and kidnappings in multiple jurisdictions, to silence perceived critics of the Iranian regime.” In return states the US Treasury Department: “Iranian security forces protect Zindashti and his criminal empire, enabling Zindashti to thrive in the country’s drug market and live a life of luxury while his network exports the regime’s oppression and on behalf of the government conducts heinous operations.” The data shows that Iran is increasingly using such criminal networks for its international operations. Iran not only takes advantage of individuals with criminal pasts, but also organized crime groups.