Iranian external operations
Iranian external operations refer to the activities conducted by the Islamic Republic of Iran in foreign countries since the 1979 Islamic Revolution. These are primarily carried out by the Islamic Revolutionary Guard Corps-Quds Force, supported by the Ministry of Intelligence and other actors. They employ military, intelligence, diplomatic, cyber, and proxy methods to advance Iran's foreign policy objectives. These operations have a global reach, with a particular focus on the Middle East, Africa, Central Asia, Latin America and Europe.
Background
Following the Islamic Revolution of 1979, Iran became a theocratic republic. Within its constitution, the Islamic Revolutionary Guard Corps is tasked not only with protecting the regime but also with exporting and spreading the Islamic Revolution worldwide. The new government in Iran subscribed to the velayat-e faqih doctrine, seeking to shift the regional status quo by opposing Western influence, particularly the US, and supporting global Shia and anti-Israel movements. The IRGC has led the execution of these operations, regularly using criminal groups to maintain plausible deniability.World's reaction to Iranian external operations
Iran's external operations have raised strong concerns for many countries worldwide, especially for those were attempts of assassinations, cyber-attacks, terrorism, and proxy violence in Europe, North America, the Middle East, took place. Most common reactions are those of formal condemnations, warnings to citizens, increased diplomatic pressure. On 1 August 2025, 14 countries, including NATO members and the US, published a joint condemnation at Iran's external operations. The condemnation referred to its intelligence threats as well as plots to "Kill, Kidnap and Harass" citizens around the world.Calls for terrorist designation
Recent years have brought European governments and the European parliament to call for the designation of the Islamic Revolutionary Guard Corps as a terrorist organization. This follows the United States and Canada's stronger measure against Iran as its plot are globally uncovered. This is emphasized in Sweden's strong stand pushing for coordinated terrorist listings to improve law enforcement and counterterrorism responses across the European Union.Sanctions and counter measures
The United States along with its allies have increased sanctions against entities and individuals linked to Iran's external operations, that includes criminal proxies, the most notable of them, is the Foxtrot Network in Sweden.The UK, German and French law enforcements and intelligence agencies have increased their efforts to expose and prevent Iranian plots targeting and including surveillance, assassination attempts, cyber intrusions targeting dissidents, Jewish, and Israeli interests.
Europe
Iran has extended the use of proxies into Europe, by outsourcing its operations to European criminal networks, with the frequency of actions increasing since 2019. These actions include assassinations, kidnapping, espionage and surveillance, targeting Iranian dissidents, Jews and Israeli-affiliated institutions.Sweden
The Swedish Security Service has confirmed that Iran uses criminal networks in Sweden to carry out violent acts against states and individuals it considers threats. The Foxtrot Network, headed by Rawa Majid acts as an Iranian proxy, targeting Israeli and Jewish groups and sites on a "target list" received from Iranian authorities. These actions include drug trafficking, arms trafficking, shootings and contract killings. Foxtrot Modus Operandi is known for recruiting minors for attacks as Swedish law prevents prosecution of those under 15 years old. Foxtrot has targeted the Israeli embassy, in the January 2024 bombing attempt and the May 2024 gunfire attack, and Elbit Systems facilities. In January 2026 it was reported that Sweden plans to lower the age of criminal responsibility from 15 to 13 in serious cases as it struggles with a growing number of children recruited into gangs to carry out violent crimes without facing serious legal repercussions.United Kingdom
Since the late 2010s, British intelligence and security officials have identified an increase in Iran's involvement in the UK through criminal networks."The Wedding" plot
In 2022, the IRGC aimed to assassinate two Iranian journalists in London, who were affiliated with Iran International, a Persian-language news channel critical of the Iranian regime. Sima Sabet and Fardad Farahzad were targeted in November 2022 by Unit 840, codenamed "the bride" and "the groom". The plot was uncovered by a double agent, and ultimately failed.2025 attempt to attack the Israeli embassy in London
In May 2025, UK police arrested five individuals, including four Iranian nationals, who were suspected of planning an attack on the Israeli embassy in London. The arrests took place during coordinated raids in London, Swindon, Stockport, Rochdale, and Manchester, as part of a major counter-terrorism operation. According to former intelligence officials and security sources, the suspects are believed to be linked to Unit 840.2025, 2026 Iran linked bots shutdown
During January 2026, as Iran imposed its longest internet shutdown to date, multiple pro-Scottish independence accounts on X went silent. This came in response to nationwide protests as a mean to cut off global internet access to suppress dissent and control information flows. This was very similar to the 2025 Internet blackout in Iran, where the matching accounts also went silent. Back in 2025 cybersecurity analysts and UK officials linked those accounts to Iran.British counter measures
Since 2022, MI5 and the police have stopped at least 20 Iranian linked plots in the UK. Intelligence suggests that Iran funded domestic criminal groups to perform violence and espionage. MI5 chief Ken McCallum has vowed to give his “fullest attention to the risk of an increase in, or broadening of, Iranian state aggression in the UK” A 2025 report issued by UK counter terrorism police states that schoolchildren have been investigated and arrested over suspected involvement in espionage, arson, and other criminal acts. These teenagers were reportedly contacted online or through existing criminal networks. This Modus Operandi is known to be used by Iran.In August 2025 it was reported that Iran's IRGC have approached the Taliban in request to obtain a leaked list of MI6 assets and 25,000 Afghans who aided UK forces. Later in August a new report showed that Iran is using a new strategy aimed to overwhelm UK security services. The method is to launch high volume and low-cost, deniable plots in order to exhaust MI5 and police resources rather than achieving real success. This is based on a belief that the UK won't increase its budget on security. Sources show that MI5 has already had to move staff away from counter terrorism, in order to deal with more threats from countries like Iran, Russia, and China, all while facing budget cuts and reduced funding for prevention programs. According to sources Iran views the UK as its main Western enemy and hopes that by creating a big enough security crisis, it can force Britain into negotiations.
On 20 August, 2025 the United Kingdom announced its sanctions on Iran's oil magnate Hossein Shamkhani, as well as four companies operating in the shipping, petrochemical and financial sectors. These sanctions were issued following the networks hostile activities and efforts to destabilize the UK and other countries, linking back to the Iranian government. According to the reports, Shamkhani was sanctioned by the US last month.
A December 2025 MI5 report, revealed how people connected to the IRGC and other Iranian government groups have continued to threaten people in the UK. They have targeted dissidents, journalists, exiles and Israelis, using spying, cyberattacks and, more recently, direct threats to harm them. In mid December two British-Lebanese men appeared in a London court charged with membership in the banned Iran backed group Hezbollah and with attending terrorism training camps. One of the men is additionally accused of assisting in buying components for drones. One defendant, Annis Makki, 40, faces multiple charges, including attending a Hezbollah training camp at the Birket Jabbour airbase in Lebanon in 2021, involvement in the preparation of terrorist acts, membership in Hezbollah, and expressing support for both Hezbollah and the banned Palestinian militant group Hamas.