Crime

By Pesach Benson, Sveta Listratov, and Kostis Konstantinou • September 17, 2025

Jerusalem, 17 September, 2025 (TPS-IL) — Iranian intelligence services are systematically outsourcing terrorist attacks to international criminal organizations, using drug cartels, biker gangs, and local criminals as proxies to target Jewish communities, Israeli interests, and Iranian dissidents worldwide, according to intelligence reports, government documents, and The Press Service of Israel’s interviews.

The strategy reflects a deliberate shift by Tehran to maintain plausible deniability while expanding its shadow war against Israel and Jewish communities. Recent arrests and foiled plots from North America to Germany to Australia reveal how the Islamic Revolutionary Guard Corps (IRGC) and Iran’s Ministry of Intelligence recruit criminals-for-hire to carry out surveillance, assassinations, and terror attacks.

Australia expelled Iran’s ambassador in August 2025 after confirming that the IRGC had ordered arson attacks on Jewish institutions in Sydney and Melbourne.

But Iran’s connection to other attacks abroad has drawn less attention. Analysts describe Tehran’s approach as “narco-terrorism”—leveraging drug cartels, smuggling rings, and transnational criminal networks to fund operations and strike adversaries while shielding the Iranian state.

“What is being revealed does not reflect the full scope of Iran’s activity,” counterterrorism expert Moran Alaluf told TPS-IL.

Alaluf is an Iran and Hezbollah researcher at the David Institute for Security Policy and a research fellow at the Institute for Israel-Africa Relations.

“Because of its sophistication, its ability to avoid fingerprints on the ground, and support from criminal organizations, local collaborators, and the extreme left, Iran is managing to remove its name from many actions,” she explained.

Dr. Omer Dostri, who studied IRGC criminal partnerships in 2022, documented how Iranian forces repeatedly relied on Turkish and Cypriot crime groups, Afghan heroin cartels, and Mexican gangs like Los Zetas to pursue strategic objectives.

“The use of organized crime provides Iran plausible deniability because these acts appear informal; there is no reason to respond or condemn them,” Dostri’s report said, published by the Jerusalem Institute for Strategy and Security.

Sweden

Iran’s criminal partnerships became evident in March 2025 when the U.S. Treasury sanctioned the Foxtrot Network, a Swedish-international crime organization involved in drug trafficking. U.S. Treasury officials said the network carried out attacks on Israeli and Jewish targets across Europe at Tehran’s instruction, including an assault on the Israeli embassy in Stockholm in January 2024.

Foxtrot’s leader, Rawa Majid, coordinated directly with Iran’s Ministry of Intelligence. The arrangement allowed Tehran to maintain “plausible deniability” while leveraging criminal expertise in weapons, logistics, and local networks.

Majid and Foxtrot were linked to attacks on Israeli embassies in Stockholm and Brussels, as well as the Elbit Systems offices in Gothenburg, recruiting teenagers to carry out the operations.

Majid remains at large, reportedly living in Iran under Tehran’s protection.

Germany

In Germany, federal prosecutors arrested a Danish citizen of Afghan origin in June 2025 on espionage charges. Ali S., according to German court records, conducted surveillance of Jewish institutions and individuals in Berlin for the IRGC’s Quds Force, which specializes in operations outside Iran.

“In early 2025, Ali S. received an order from an Iranian intelligence service to collect information on Jewish localities and specific Jewish individuals in Berlin. To this end, he surveilled three properties in June 2025, presumably in preparation for further intelligence activities in Germany, possibly including terrorist attacks on Jewish targets,” Germany’s Federal Public Prosecutor General’s office said in January.

Sacha Stawski, president of the Frankfurt-based antisemitism watchdog Honestly Concerned, said intimidation has forced many Jews to “hide their symbols” or consider leaving Germany.

“The third option is to fight as long and as strongly as you can. We know these attacks will keep happening, and Iran is involved. Awareness is rising,” he told TPS-IL.

Greece

Greek authorities grew suspicious in 2024 when an Iranian man was arrested alongside an Afghan and a Greek attempting to set fire to an Athens synagogue.

A senior politician in Greece’s ruling New Democracy party, familiar with intelligence and security issues, told TPS-IL that Tehran has established contacts with far-left and anarchist groups, including Rouvikonas, a violent organization linked to the dismantled “17 November” terrorist group, which coordinates anti-Israeli and anti-Jewish actions.

“Iran now considers Greece hostile territory because of Israel,” the source said, adding that Tehran uses local figures to destabilize Greek-Israeli relations.

United Kingdom

Britain’s MI5 disclosed that it had disrupted at least 15 Iranian plots to kidnap or kill dissidents, journalists, and regime critics.

United States

As far back as 2011, an Iranian agent tried to recruit a Los Zetas cartel member to assassinate Saudi Arabia’s ambassador in Washington, as well as diplomatic targets in Argentina.

In 2022, four Iranian operatives were charged with attempting to abduct journalist Masih Alinejad, part of a larger campaign to target dissidents in Canada, Britain, and the UAE.

Naji Sharifi Zindashti, a drug lord under IRGC protection, was sanctioned by U.S. and U.K. authorities in 2023 for links to assassination plots, including attempts to hire a Hells Angels biker to kill an Iranian defector in Maryland.

In November 2024, a federal indictment in New York accused Farhad Shakeri, an IRGC asset in Tehran, of using a U.S. criminal network of former prison associates for contract killings.

Court documents showed Shakeri ordered surveillance and the murder of two Jewish American business owners who supported Israel, offering $500,000 per target, and planned a mass shooting of Israeli tourists at Sri Lanka’s Arugam Bay, supplying AK-47s to local operatives. Evidence included recorded conversations, messages, photos, and payments for reconnaissance and planning.

Canada

In 2024, Canadian authorities thwarted an Iranian plot to assassinate former Justice Minister Irwin Cotler, a long-time critic of Tehran.

Joe Adam George, a Canadian analyst specializing in Islamist threats, explained to TPS-IL that “local criminal gangs can be recruited to act on Iranian orders, creating challenges for law enforcement.” George also specializes in Islamist threats in Canada for the Macdonald-Laurier Institute and the Middle East Forum.

“Iran and its proxies, such as Hezbollah, have a documented history of exploiting criminal networks in Canada and elsewhere to carry out terrorism, illicit financing, drug trafficking, intimidation, and violence—all while maintaining plausible deniability,” he said. “This creates significant political, operational, geographic, and legal hurdles for law enforcement, as the individuals directing these operations are often based abroad, particularly in Iran and other rogue states.”

George called for a “comprehensive, multi-faceted approach,” including sanctions, military deterrence, intelligence sharing, IRGC designation as a terrorist organization, and stronger law enforcement.

International Response

The U.S. Treasury noted that Iran “increasingly relies on organized criminal groups…to maintain plausible deniability,” complicating detection and attribution.

In July 2025, 14 Western nations, including the U.S., U.K., Canada, and 11 European allies, issued a joint statement condemning Iran for collaborating with international criminal organizations to target journalists, dissidents, Jewish citizens, and officials.

“We are united in our opposition to the attempts of Iranian intelligence services to kill, kidnap, and harass people in Europe and North America in clear violation of our sovereignty. These services are increasingly collaborating with international criminal organisations to target journalists, dissidents, Jewish citizens, and current and former officials in Europe and North America. This is unacceptable,” the statement said.

For Jewish communities, Iran’s strategy creates unprecedented vulnerability. Criminal networks operate differently from traditional terror cells, complicating conventional counterterrorism approaches.

Analysts cautioned that arrests, sanctions, and intelligence revelations likely reflect only a fraction of Tehran’s broader activity. Many plots remain undetected or unattributed, keeping Western security services one step behind.

“There are many dormant cells waiting for the green light,” Alaluf warned.