Tehran’s Hybrid Threat Looms Over Europe

Iran’s multifaceted network of proxies and covert operatives is poised to broaden its campaign of retaliation against Israel by extending its operations into Europe. Having weakened regional assets such as Hezbollah, the Houthis and Hamas, Tehran is reportedly turning to clandestine cells and criminal syndicates across the continent as a new front in its “ring of fire”.

Heightened security advisories for Jewish communities from London to Berlin underscore rising concerns as European intelligence agencies monitor suspected Iran-linked plots. Authorities in the UK, Germany, Sweden and Denmark have disrupted several operations targeting Israeli diplomats, embassies and Jewish civilians—some orchestrated via local criminal networks with direct ties to Tehran’s Islamic Revolutionary Guard Corps.

Intelligence analysts stress that Iran’s reach now hinges less on traditional regional proxies—many of which have been degraded—and more on a decentralised approach involving covert units like IRGC’s Unit 840 and local gangsters. This network reportedly recruits individuals in Germany, the UK, France, Poland and beyond to carry out sabotage, assassination and terror acts, frequently under the guise of criminality.

Security efforts across Europe have ramped up significantly. The arrest in May of five IRGC operatives allegedly plotting an attack on the Israeli embassy in London highlighted the sophistication and financial backing behind these schemes. Authorities are also linking freelance European hit teams and criminal groups to assassination plots, with some operatives reportedly motivated by payoffs ranging from US$150,000 to a million dollars.

Cyber attacks are another weapon in Iran’s hybrid arsenal. Hackers associated with Tehran, including the so-called Rocket Kitten team and the CyberAv3ngers group, have launched campaigns against Israeli and Western targets that exploit vulnerabilities in industrial infrastructure, telecoms and financial systems. CyberAv3ngers has inflicted disruptions on water, gas and oil installations in the US and Ireland, signalling a shift toward long‑range asymmetric strikes.

The strategic logic behind Iran’s shift became more apparent after Israel’s direct offensive on Iranian territory earlier this month. That attack severely diminished Tehran’s conventional deterrence capability—destroying air defences, militarily significant centres and the command structures of its nuclear and ballistic programmes. According to analysts, Iranian conventional power has “limited retaliation options” following the degradation of Hezbollah and other proxies.

European capitals are now bracing against a diffuse and stealthy form of retaliation. French counter‑terrorism officials have warned that Europe could become a target for future attacks, ranging from embassy assaults to direct threats against Jewish communities, Israeli commercial interests and diaspora groups.

Iran has yet to publicly confirm its involvement in these specific plots. Nevertheless, its heavy investment in Unit 840 and other clandestine networks, along with historical precedents—including the 1994 AMIA bombing in Argentina—suggest a long‑term capability and intent to act on Western soil.

These developments pose fresh challenges for European security services. They must now counter hybrid threats combining cyber warfare, proxy violence and criminal operations—without igniting overt confrontation with Tehran. Some intelligence experts argue that the EU’s exclusion from ongoing diplomatic negotiations between the US and Iran may limit its ability to influence deterrence or de‑escalation efforts.

Diplomats in Brussels and capitals across Europe are now pursuing a dual-track approach: strengthening homeland security and pressing for an inclusive diplomatic framework that brings Europe into strategic discussions. As European agencies enhance surveillance of IRGC-linked operatives and cyber networks, officials stress that vigilance, community protection and inter-agency collaboration will remain central to averting next‑generation threats.