UK Jewish communities under growing threat from Iran’s covert proxy network after antisemitic arson and spy probes, experts warn
Iran is expanding a shadow campaign across Europe using what experts describe as a “gig economy of hostile activity”, outsourcing surveillance, intimidation and potential attacks to criminal networks and loosely connected operatives.
Listen to this article
Security analysts warn the model, designed to give Tehran plausible deniability, is increasingly being used to target Jewish communities, businesses and institutions, including in the UK.
Michael McManus, Director of Research at the Henry Jackson Society, said the approach marks a clear evolution in Iran’s playbook.
“Iran has long relied on plausible deniability, using proxies from terrorist groups like Hezbollah and Hamas down to criminal networks and freelance operatives,” he said.
“That model is now evolving into a gig economy of hostile activity, enabling Tehran to conduct low-level sabotage, intimidation and surveillance across Europe while obscuring responsibility.”
He added that the tactic mirrors Russian grey-zone warfare, where deniable actors operate below the threshold of open conflict.
“The result is a growing threat to UK infrastructure, businesses and communities that is harder to detect, attribute and deter,” he said.
The warning comes amid growing scrutiny of emerging groups believed to be fronts for Iranian operations.
Joe Truzman, a security analyst at the Foundation for Defence of Democracies, said one such group, Harakat Ashab al-Yamin al-Islamia, bears the hallmarks of an Iranian construct.
“I’m not surprised that we are seeing another attack, especially against a Jewish institution. We don’t know a lot about this organisation. It is certainly new,” he said.
“My suspicion is that we are observing an Iran-crafted front, meaning that this is an organisation that has been created by Iran, perhaps the Islamic Revolutionary Guard Corps, to carry out attacks specifically against Jewish institutions.”
He pointed to telltale signs in the group’s presentation and targeting.
“Their logo with the wording is a sign of a classic Iranian front organisation,” he said.
“What we have been seeing with almost all of these attacks is that they are going after symbols of either Israel or Jewish institutions.”
Truzman added that the operational style suggests outsourcing rather than a tightly controlled militant group.
“Here I think we are seeing a little bit of amateurism. I don’t think this is being done by a well-established organisation. I suspect that Iran is outsourcing these attacks to criminal organisations.”
That assessment is echoed by intelligence specialists who say Iranian-linked activity across Europe has increasingly relied on informal networks rather than trained operatives.
Jonathan Hackett, a former US Marine Corps intelligence specialist, said the Islamic Revolutionary Guard Corps (IRGC) has already demonstrated a pattern of targeting Jewish communities through surveillance and intimidation.
“The IRGC conducts extensive surveillance of targets fitting certain profiles, such as important members of the local Jewish community, businesses associated with Jews, and other targets of opportunity,” he said.
He pointed to activity uncovered in Germany and France between 2017 and 2025, where Iranian-linked networks mapped potential targets.
“The IRGC primarily seeks to subvert local Jewish communities, sabotage Jewish-linked facilities such as synagogues and community centres, and terrorise those affiliated with these targets,” he added.
Security sources say the real concern for the UK is not a single large-scale attack, but a steady stream of smaller, deniable incidents carried out by individuals with little obvious connection to Tehran.
The use of criminal gangs and ad hoc operatives allows Iran to maintain distance while still applying pressure, creating a persistent, low-level threat that is difficult for security services to pin down.
It also means the barrier to entry is lower than ever. No need for a trained cell when a willing recruit with a phone and a payment channel will do.