The Islamic Republic of Iran has long been accused of operating in the shadows, orchestrating intelligence operations against political dissidents, journalists, and foreign adversaries. But in 2025, that shadow appears darker and more extensive than ever before stretching from the Nordic frontiers to the heart of Europe, leaving behind a trail of threats, covert violence, and transnational repression.
In a watershed moment for Finnish security policy, the Finnish Security and Intelligence Service (Supo) publicly named Iran alongside Russia and China as a major espionage threat to the country. It was the first time Finland officially placed Tehran in the same category as Moscow and Beijing. Supo’s statement, issued on May 30, underscored that Iranian operations are focused primarily on tracking, intimidating, and ultimately silencing dissidents living abroad.
This is not an isolated Nordic concern. Swedish authorities had already sounded the alarm in March, warning of an escalation in Tehran’s activities in Scandinavia. The Swedish Security Police revealed that Iran is increasingly relying on organised crime networks to strike at opposition figures and Israeli interests within Europe. Among the most disturbing revelations was Tehran’s use of Sweden-based criminal gangs to stage attacks on diplomatic targets.
The U.S. Treasury Department echoed those concerns by designating Sweden’s Foxtrot gang as a transnational criminal organisation earlier this year. The group had been implicated in violent operations ordered by Iran’s Ministry of Intelligence (MOI), including a failed assault on the Israeli embassy in Stockholm. Not to be outdone, Foxtrot’s rival gang, Rumba, carried out a similar embassy operation in May 2024, also allegedly under Iranian direction.
If Scandinavia illustrates Tehran’s intelligence reach, the United Kingdom offers a chilling example of how far these operations have progressed. In early May, British counter terrorism authorities arrested seven Iranian nationals in what officials described as one of the most serious counterintelligence operations in recent memory. Several of the suspects had entered the UK under the guise of asylum seekers. By May 17, three had been charged with engaging in activities linked to Iran’s intelligence services—targeting exiled journalists and media outlets critical of the regime.
These operatives are reportedly affiliated with Unit 840, a clandestine branch of the Islamic Revolutionary Guard Corps-Quds Force (IRGC-QF). Though relatively new on the scene, Unit 840 has become a key vehicle for Tehran’s global reach, allegedly carrying out abductions and assassination attempts from Europe to Latin America.
Meanwhile, across the Atlantic, U.S. authorities have begun publicly naming senior Iranian intelligence operatives believed to be orchestrating these efforts. On May 23, the FBI issued a wanted poster for Seyed Yahya Hosseiny Panjaki, a high-ranking MOI official linked to multiple assassination plots. Panjaki’s name is now synonymous with Iran’s global campaign of repression. He is believed to have overseen the establishment of a special MOI unit named after slain IRGC commander Qassem Soleimani and to have managed the infamous Naji Sharifi Zindashti network a syndicate accused of plotting killings on U.S. soil using members of the Canadian Hells Angels and conducting attacks in Germany.
Court documents in both the U.S. and Turkey paint a grim picture: Iran is no longer simply targeting high-profile opposition figures through intelligence operatives. Increasingly, it is outsourcing repression to criminal gangs, creating a buffer of deniability while accelerating its extraterritorial campaigns. This tactic allows Tehran to distance itself diplomatically from the violence it directs, even as its fingerprints remain visible to those who know where to look.
Nowhere is this more evident than in Israel. On May 20, Israeli authorities arrested two citizens in the town of Kfar Ahim, home to Defense Minister Israel Katz. The pair were charged with conducting surveillance and intelligence gathering on behalf of Iran, recruited via Telegram and in constant communication with handlers through encrypted apps. Authorities say they were likely preparing to retrieve a buried explosive device as part of a larger operation.
The arrests are only the latest in what Israeli police describe as an unprecedented surge in Iranian espionage. Over the past year alone, more than 30 Israelis have been detained for allegedly cooperating with Iranian intelligence some accused of photographing sensitive military locations, others of plotting assassinations. Superintendent Maor Goren, who leads Israel’s counterintelligence unit, described the scale as “unlike anything we’ve seen before.”
This escalation in covert warfare comes amid rising hostilities between Tehran and Jerusalem, punctuated by direct missile exchanges in April and October 2024. With Iran’s espionage efforts intensifying in tandem with its public provocations, the message is clear: the Islamic Republic is no longer content with passive resistance; it is moving aggressively, and globally, to shape the world in its image.
The international community must come to terms with this reality. Tehran’s intelligence apparatus is no longer confined to the Middle East. It has become a global force, skilled at weaponizing local gangs, exploiting asylum systems, and targeting democratic institutions. In this new era of hybrid threats, the cost of ignoring Iran’s covert aggression could be catastrophic—not just for dissidents or diplomats, but for the security architecture of the West itself.
