Western security services aren't just worried about missiles anymore. They're worried about the teenager on a motorbike with a bottle of gasoline. Over the last few months, a strange and unsettling pattern has emerged across Europe. It isn't the high-tech, cinematic espionage you see in movies. Instead, it's cheap, messy, and intentionally loud.
Iranian intelligence services have shifted their strategy. They’re now outsourcing "hybrid warfare" to common criminals and local gangs to target dissidents and Jewish communities in the UK and Europe. If you've seen the headlines about random arson attacks or weird surveillance cases in London and Amsterdam, you're looking at the new front line of a very old grudge.
The outsourcing of terror
For years, the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence (MOIS) used their own agents for "wet work"—assassinations and kidnappings. But professional spies are expensive and hard to replace when they get caught. Now, they’ve found a loophole: disposable operatives.
By using criminal intermediaries, Tehran gets "plausible deniability." If a gang member gets caught setting fire to a car in London, he looks like a common criminal, not a state agent. It’s a low-risk, high-reward system. These recruits are often teenagers or low-level thugs who don't even know who they’re really working for. They just know they’re getting paid a few thousand dollars to cause trouble.
The scale of this is bigger than most people realize. In March 2026, two people were charged under the National Security Act for spying on Jewish sites in London. Since the joint US-Israeli strikes on Iranian soil in February 2026, the intensity has spiked. We aren't talking about strategic military hits. We're talking about IEDs at synagogues in Liège, cars burned out in Rotterdam, and "HAYI"—a group likely linked to Iranian influence—claiming responsibility for attacks across the Netherlands and France.
Why the UK is the primary target
The UK has always been a thorn in Tehran's side. Between a large Iranian dissident population and the UK’s unwavering support for Israel, London is a natural target. MI5 chief Ken McCallum hasn't been quiet about this. He recently noted that the service had tracked over 20 potentially lethal plots backed by Iran in just a year.
It’s a classic intimidation tactic. By making life dangerous for dissidents and Jewish citizens, Iran sends a message to the British government: "If you interfere with us, we’ll make your streets unsafe."
The psychological toll is the real goal. These attacks aren't meant to kill hundreds; they're meant to make you look over your shoulder. When a Jewish school in Amsterdam is targeted or an RAF base in Cyprus is buzzed by a drone, the physical damage might be minor, but the anxiety is permanent. That’s the "hybrid" part of the warfare. It blends physical violence with psychological operations and cyber disruption.
The cyber front is just as loud
While the arson and surveillance grab the headlines, the National Cyber Security Centre (NCSC) is fighting a quieter war. According to NCSC chief Richard Horne, the UK is now facing roughly four "nationally significant" cyber incidents every single week.
Iran, alongside Russia and China, is a main driver of this. They aren't just looking for money via ransomware. They’re hunting for data on dissidents and trying to find vulnerabilities in critical infrastructure like the NHS or the power grid. It’s all part of the same toolkit. If they can’t get a physical agent close to a target, they’ll use a keyboard to harass them or leak their personal information to incite "lone wolf" attacks.
How to spot the patterns
This isn't random chaos. Security analysts have identified three main pillars of this current Iranian campaign:
- Targeted Dissidents: Iran is obsessed with silencing anyone who speaks against the regime from abroad. This includes journalists at outlets like Iran International.
- Jewish Community Infrastructure: Targeting synagogues, schools, and even volunteer ambulances serves to inflame local tensions and project power.
- Deniable Sabotage: Using arson and small-scale explosives that can be written off as "gang activity" until intelligence agencies connect the dots.
The use of Shahed drones is another growing concern. While they haven't been used to strike London directly, the recent drone incident at Akrotiri in Cyprus shows that Iran is willing to push the boundaries of where its "proxies" can reach.
Moving beyond the headlines
If you live in a major European city, don't panic, but do be aware. The "disposable" nature of these operatives means they often make mistakes. They’re sloppy. That’s why so many of these plots are foiled.
The best defense for the public is staying informed and reporting suspicious surveillance. If you see someone filming security entrances or exits of community centers repeatedly, tell someone. These "scouts" are often the first step in a coordinated hybrid attack.
Governments are already reacting. Expect to see more prosecutions under the National Security Act and potentially the long-awaited proscription of the IRGC as a terrorist organization in the UK. The "shadow war" isn't in the shadows anymore; it's right in front of us, and it’s time we started calling it what it is—state-sponsored thuggery designed to test our resolve.
Keep an eye on the news out of the Netherlands and Belgium. Those countries are often the testing grounds for tactics that eventually make their way across the Channel. Don't fall for the "lone criminal" narrative when a pattern is this obvious. Be vigilant, stay skeptical of "unclaimed" incidents, and realize that in 2026, the distance between Tehran and London is shorter than it looks on a map.
