The Islamic Revolutionary Guards Corps and its proxy Hezbollah have been activating sleeper cells embedded across the Gulf States, but many have been found and detained.
With no clear end in sight to hostilities involving the United States, Israel, the Gulf states, Iran, and its regional proxies, the Middle East is passing through an especially tense period. Warfare is being waged overtly, both militarily and economically, but also covertly, with numerous clandestine domestic cells across the region only adding to the noxious mix.
Deep in the fabric of states are understood to be shadow networks linked to Iran’s Islamic Revolutionary Guards Corps (IRGC) and Hezbollah, the Iran-backed militia in Lebanon that has been targeted tirelessly by Israel since 2024. Iran’s apparent move is towards ‘exporting disorder’—a phrase referencing Iran’s famous 1979 mantra to ‘export the revolution’. This has become a means of targeting the security and economic infrastructure of the Gulf states from within, from Kuwait in the 1980s to this year’s security operations.
Tehran has embraced asymmetric warfare to inflict maximum damage with tools that enable it to compete despite the power imbalance. Alongside this, networks linked to Iran and its proxies have moved beyond sabotage; they have become intelligence and command units, shifting from sleeper-cell inactivity to active operations designed to disperse defensive efforts and unsettle economies. From information gathering, they have moved to assassinations, ballistic missile movements, and money laundering using cryptocurrencies.
Smoke rises from an area of Kuwait's international airport after a reported drone strike on 1 April 2026.
Kuwait
Kuwait offers the clearest model for understanding the evolution of the IRGC’s management of its affiliated groups. Today, its plots target symbols of the state, but Iran first sought to ‘export the revolution’ in Kuwait with a series of bombings in 1983 that targeted the embassies of the United States and France, Kuwait International Airport, and a petrochemical plant. Investigators pointed the finger at elements linked to the Islamic Dawa Party, from which Hezbollah emerged, initially in retaliation for Kuwait’s support for Iraq and the United States during the First Gulf War.
Among the most prominent figures associated with that era were the Iraqi paramilitary leader Jamal Jaafar Ali al-Ibrahimi, known as Abu Mahdi al-Muhandis, and the Lebanese militant Mustafa Badreddine, a Hezbollah operative linked to the assassination of Lebanon’s former Prime Minister Rafik Hariri. In 1985, the cells tried to assassinate Kuwait’s late Emir, Sheikh Jaber al-Ahmad al-Sabah, with a car bomb targeting his convoy. It was described as an Iranian political message.
Networks linked to Iran and its proxies have moved beyond sabotage; they have become intelligence and command units
That same year, bombs targeted cafés, spreading fear. In 2015, Kuwaiti security services arrested the 'Abdali Cell', finding 19 tonnes of ammunition and 144kg of explosives on a border farm. It exposed the recruitment of Kuwaiti citizens and their training in Hezbollah camps in Lebanon under the supervision of the IRGC with the aim of spreading the principles of Iran's Wilayat al-Faqih (Guardianship of the Islamic Jurist) clerical governance model.
Earlier this year, as the US and Israel attacked Iran and the latter responded by attacking Gulf states, Kuwait's security service arrested a network it said was linked to Hezbollah and that had been planning to assassinate officials. The cell reportedly used antiquated communication methods, such as Morse code, to evade advanced electronic surveillance. Under the cover of companies, restaurants, and investment firms, the cell is believed to have facilitated the entry and exit of known operatives into Kuwait.
US military barracks in Dhahran, Saudi Arabia after an attack killed 19 service members in June 1996.
Saudi Arabia
The IRGC is thought to have tried to plant an armed proxy called Hezbollah al-Hijaz to carry out operations in Saudi Arabia, where the 1996 bombing of the Khobar Towers remains fresh in the memory. The explosion of a booby-trapped tanker killed 19 American servicemen and one Saudi citizen.
Investigations established Ahmed Ibrahim al-Mughassil as the mastermind and commander of the group. Saudi intelligence arrested him in Beirut in 2015. Investigations revealed his family's links to Hezbollah. His son, Imran Ahmed al-Mughassil, was killed in southern Lebanon in November 2023. Imran had been part of a financial network that included tourism companies in Lebanon and Iran, helping to move funds to support the Houthis in Yemen.
Bahrain
IRGC activity in Bahrain has taken the form of field intelligence. In March this year, Bahrain's attorney-general announced the referral of 14 defendants accused of espionage on behalf of Iran. Allegedly, the unit was tasked with monitoring and photographing defence sites and sensitive energy facilities, while using advanced encryption software to transmit live data and precise coordinates to Iran.
Data sent by these cells was used to ensure that Iranian ballistic missiles and drones hit their targets inside Bahrain, including an oil refinery. Some members of the group are even understood to have corrected missile trajectories. Other members reportedly spread disinformation through electronic accounts managed from Iran.
A smoke plume rise from an ongoing fire near Dubai International Airport in Dubai on 16 March 2026.
United Arab Emirates
While cells in other countries have focused on sabotage, the UAE has faced a more complex Iranian strategy focused on finances and money laundering. On 20 March 2026, the State Security Service said it had found and dismantled a network financed and managed by Hezbollah and Iran.
Its activities reportedly include the laundering of gains made from the manufacture and sale of Captagon, an addictive amphetamine-type stimulant mostly made in Syria and widely consumed across the region. The cell is also believed to have sought to evade Western sanctions by buying dual-use equipment, including advanced computer chips and drone components, before shipping them to Iran.
Cryptocurrency trading platforms have helped finance Hezbollah's external operations, but some cells have been shown to favour gradual assimilation into local, stable Gulf communities, building cover and networks.
Smoke rises from an area in the direction of Al Udeid Air Base, which houses the Qatar Emiri Air Force and foreign forces including the US, in Doha on 28 February 2026, following a reported Iranian strike.
Qatar
In March, Qatari authorities said they had uncovered ten suspects from two cells affiliated with Iran's Revolutionary Guard, marking a shift in bilateral relations after years of Doha's delicate diplomatic balancing. This coincided with Iranian missile attacks on Qatar's Al Udeid Air Base and energy facilities. The suspects reportedly admitted to having been assigned espionage and sabotage missions after the coordinates for sensitive facilities and encrypted communication tools were found in their possession.
Modus operandi
The networks operating with the IRGC and Hezbollah take several forms. Operations are often managed from outside the Gulf states, whether from Tehran or Beirut's southern suburbs. Communication is established with local or expatriate elements, many of whom have received military and intelligence training in camps. They are supported by actors engaged in digital and media manipulation, operating in the field of public affairs and public opinion.
Recruits, who are often first spotted in religious centres, are taught that this is the sole path to "liberating Jerusalem and confronting the enemy". Over time, they come to see their own national (Gulf) state as an obstacle to that project. Once indoctrinated, they coalesce into networks known as sleeper cells and operate through clandestine methods.
This picture, taken on 27 July 2022, shows sacks of confiscated captagon pills at the judicial police headquarters in the town of Kafarshima, south of Lebanon's capital, Beirut.
To fund their activities, Hezbollah and Iran have increasingly turned to the illicit economy, with the Captagon trade having become a central pillar. The Lebanese-Syrian border is now a vast production zone for the drug, which is later smuggled into the Gulf states. They even work with drug cartels in South America, particularly the tri-border area between Argentina, Brazil and Paraguay. Drug money is then laundered through the trade in used cars or gold.
In recent months, Gulf states have been developing systems to track 'digital money laundering', working together and sharing intelligence. Banks and exchange houses are now required to submit 'suspicious transaction reports' immediately, so that the individuals behind them can be tracked. In parallel, they have imposed strict oversight on political groups and tightened monitoring of any activity linked to political Islam, whether Sunni or Shiite. In the Gulf states' efforts to stifle Iran's influence in the region, no stone is being left unturned.
