An Iranian threat to Europe no longer looks like the terrorism of an earlier era. It may look instead like two men conducting surveillance of an embassy, young local criminals lurking near a military base, a gang hired to attack a Jewish target, a charity moving money, an art dealer facilitating sanctions evasion, or a commercial company procuring dual-use technology.
Recent events in Britain illustrate the problem. On 9 October, two men pleaded not guilty at the Old Bailey to accusations that they had carried out hostile surveillance on behalf of Iranian intelligence services. Their alleged targets included the Israeli Embassy and Consulate in London, Bevis Marks Synagogue and other Israeli or Jewish interests. The allegations concern reconnaissance conducted in July and August 2025 and remain to be tested at trial.
Even more striking is the ongoing investigation into activity around RAF Fairford, the British airbase used by the United States. British authorities are investigating a suspected terrorist plot after masked men and three vans were discovered near the base on 27 September. US officials later said intelligence indicated a possible planned Iranian drone attack, and the United States subsequently removed B-1 bombers from Fairford. Iran denies involvement, and the investigation remains open.
These incidents are important not simply because Iran may have been behind them. They point to a much larger transformation in the way Iran projects coercive power abroad. Iran-linked activity can no longer be understood principally as a collection of terrorist plots conducted by Iranian intelligence officers. What has emerged instead is an adaptive transnational architecture connecting state agencies, proxies, organised crime, financiers, charities, educational institutions, commercial fronts, and local intermediaries.
Changed methods
Iran has long conducted hostile operations abroad. But the methods have changed. The 2018 plot to bomb a gathering of Iranian opposition figures outside Paris represented an older model. Assadollah Assadi, then an accredited Iranian diplomat based in Vienna, was subsequently convicted for his role in the plot. His prosecution demonstrated the costs of using officials carrying diplomatic cover for terrorist activity.
Since then, Iran has increasingly moved towards outsourcing, as criminals and local intermediaries are easier to recruit, harder to connect conclusively to the Iranian state, and ultimately expendable. Sweden offers perhaps the clearest example. The US Treasury concluded that the Foxtrot criminal network carried out an attack against the Israeli Embassy in Stockholm in January 2024 on Iran's behalf.
The British government has now gone further in publicly attributing this model to Iran. In July, it sanctioned the Islamic Movement of the Companions of the Right, also known as IMCR or HAYI, after the group claimed seven attacks against Jewish, Israeli, and Persian-language media targets in Britain. The UK government assesses that members of the Islamic Republican Guards Corps (IRGC) Quds Force were behind the organisation and “almost certainly” directed its attacks across Europe.
This is what makes the Fairford investigation particularly significant. If an Iranian connection is later established, it shows a state's ability to turn relatively unsophisticated local actors into instruments capable of forcing a major military power to alter its deployment of strategic assets. Iran can also use such hired local actors to send a low-level threat message to the US.
