European nations are increasingly confronting a clandestine but growing threat from Iranian-linked Shia actors, who are employing criminal networks and intermediaries to carry out covert operations against dissidents, journalists, and diplomatic targets. The phenomenon, which has intensified since the mid-2010s, has prompted several governments to strengthen intelligence cooperation and security measures in response to a perceived escalation in Iranian state-sponsored activities.

Strategic Operations and Plausible Deniability

According to official documents from several European governments and Western allies, Iranian intelligence services have been working closely with local criminal groups to conduct operations that would otherwise be traced back to Tehran. These networks range from structured criminal organizations to individuals with criminal histories, allowing Iran to maintain plausible deniability and avoid direct attribution of such actions.

The operational pattern typically targets individuals critical of the Iranian regime, including political dissidents, journalists, and diplomats. These operations can involve everything from surveillance and intimidation to assassination attempts and kidnappings. In 2025, a joint statement from the United States, United Kingdom, Spain, France, Germany, Sweden, and other allies condemned the actions of Iranian intelligence services, stating they violated the sovereignty of the signatory states.

Historical Context and Regional Tensions

The threat is not a new development, but rather an evolution of long-standing Iranian influence in Europe. For decades, Iran has cultivated ideological and logistical networks in European countries with large Lebanese, Iranian, or Shia communities. These networks have served as a platform for political and logistical support to the Iranian regime.

Since the early 2020s, European intelligence agencies have documented the export of repressive activities by Iran to European soil through legal and diplomatic entrapment, financial channels, and covert operations disguised as cultural or religious organizations. One notable example is the series of incidents in Europe targeting Iranian dissidents in Sweden and Belgium, as well as perceived opponents of the regime.

Institutional reports, such as the Europol-produced TE-SAT 2024, highlight the continued dominance of jihadist terrorism in the European Union. However, they also note that global geopolitical conflicts, particularly those involving the Middle East, have influenced European internal security, contributing to radicalization and criminal activity.

Country-Specific Responses

Spain has been one of the most affected countries, particularly after the attempted assassination of politician Alejo Vidal-Quadras in Madrid in November 2023. According to reports from Dutch intelligence, this attack followed patterns associated with Iranian-linked criminal networks. Spain has since increased security around embassies and Jewish and Israeli community institutions, while also enhancing intelligence-sharing with other European agencies.

France, due to its geopolitical influence and diverse population, has been one of the European states with the most strategic attention to these threats. French security services have documented operations involving the surveillance of Iranian dissidents, infiltration of opposition groups, and attempts at targeting political or diplomatic figures. In response, France has heightened protection for Jewish communities and diplomatic institutions with tensions over Iran.

German authorities have reported an increase in intelligence and espionage activities conducted by agents linked to the Iranian state. These operations focus on opponents of Tehran and civil society organizations, as well as surveillance of Jewish and Israeli community members. Germany has strengthened counterintelligence efforts to intercept these operations before they lead to violence.

The United Kingdom has taken a legal and law enforcement approach to neutralize suspected networks linked to Iran. Authorities have arrested individuals allegedly planning attacks against regime-critical targets or Jewish communities. The UK has emphasized the use of both police and legal mechanisms to prevent such threats from materializing.

The Netherlands has explicitly linked Iran to the foiled attack in Madrid and other attempts against dissidents. Dutch intelligence has confirmed that Iranian operatives are likely behind these actions, which have led to increased scrutiny of individuals and groups suspected of operating on behalf of the Iranian regime.

As tensions in the Middle East continue to rise, particularly between Iran, the United States, and Israel, European governments are likely to face more of these covert challenges. The use of third-party intermediaries and criminal networks allows Iran to maintain a low profile, making it harder for European intelligence to fully trace and counter these operations.

With several European countries now openly addressing the threat, it is expected that future policies will include stronger legal frameworks, enhanced intelligence collaboration, and increased security measures for high-profile individuals and institutions that could be targeted by Iran-linked actors.