The rise of Iran’s sleeper cells in Europe

A spate of attacks on Jewish communities across Europe in March this year evidences that Iranian sleeper cells are awakening, under directions from Teheran. Experts believe that Iran has recruited criminal elements to these cells, capable of committing violent acts with no regard for human life.

Thomas Renard is director of the International Centre for Counter-Terrorism. He believes Iran has adopted a model developed by the Russians that allows for arms-length operations with the opportunity for plausible deniability. And they are not too fussy about who they recruit:

“To target its enemies on European soil, Iran prefers to rely on criminal networks, with whom they have developed ties. These organisations provide guns for hire and can perform certain services such as assassination. More recently, however, it looks like Tehran is preferring the use of “disposable agents” recruited online to perform small tasks for small sums of money.

Dr Andreas Krieg is a Fellow at the Institute of Middle Eastern Studies and a security expert at King’s College London. He agrees that Iran has no qualms about using criminals as proxies, “from organised traffickers to low-level crooks”. As a result, an attack may sometimes resemble an ordinary assault, random case of arson, or an “immigration irregularity” as opposed to state-directed violence.

The pattern UK authorities describe is not one of mass-casualty armies waiting underground, but of surveillance, assassination plotting, intimidation, and attacks or attempted attacks against dissidents, journalists, and possibly Jewish or Israeli-linked targets. In other words, the danger is less a sudden national uprising and more a shadow campaign of selective violence and coercion.

March brought a wave of attacks on Jewish properties. In the early hours of 9 March 2026, a bomb went off outside a synagogue in Liège, Belgium. The Belgian authorities responded by putting troops on the streets. There was also an attack on a synagogue in Rotterdam, Netherlands, which led the country’s justice minister, David van Weel, to raise the possibility of Iran’s involvement.

Then came an extraordinary incident in London. During the night of 23 March 2026, four Jewish volunteer ambulances, run by the London-based charity Hatzola Northwest, were destroyed in an arson attack. CCTV footage showed three hooded figures, dressed head to foot in black, setting fire to the vehicles in the Golders Green district. A group calling itself Harakat Ashab al-Yamin al-Islamiya claimed responsibility on its Telegram channel.

It also boasted about carrying out the synagogue attacks in Belgium and the Netherlands. The message from these terrorists, and their backers in Teheran, was simple: we are bringing the war to you. By unleashing violence on the streets of western European cities, the strategy is to undermine support for action against the regime in Iran.

But what exactly is Harakat Ashab al-Yamin al-Islamiya? Renard has little doubt that Teheran is pulling the strings:

It is most likely an Iranian cover. A group set up by the Iranian services, to give a semblance of coherence to the current campaign of attacks and maintain plausible deniability. Every indication points to Iran, such as the iconography of the group and the online ecosystem (pro-Iranian) where it first appeared.

And was the group a known entity before March this year?

No, the group didn’t exist until 11 March, when they claimed the synagogue bombing in Liège. The group came out of nowhere but was immediately intertwined with pro-Iranian online groups with a large followership, which would be hard to imagine for such a new group, unless it is created by Iran.

The group is possibly an Iranian sleeper cell, now coming to life. This opens a new front in Iran’s counter-offensive against the west resulting from the ongoing conflict in the region. It poses a major headache for intelligence agencies and law enforcement, creating a threat level not seen since the ISIS-inspired “lone wolf” outrages of the last decade.

So, what exactly is a “sleeper cell”? Krieg believes they can be a single person or a small group living seemingly normal lives until directed to do something. Their backgrounds can be very mixed, including petty criminals.

More often, it means a mix of pre-positioned operatives, facilitators, criminal proxies, sympathetic contacts, or people tasked with surveillance, intimidation, logistics or violence when needed. If such assets exist in Britain, they would most likely be in large cities where anonymity is easier and where there are international business, transport and diaspora links. That is an operational point, not a judgment on any community.

Renard agrees that sleeper cells could be part of Iran’s strategy to bring mayhem to western cities, but Teheran may still be holding back on deploying them. Instead, these recent attacks might be the work of lower-level operatives:

Sleeper cells, like covert operatives are long term operations, that take a lot of time to build and maintain. In other words, these are very precious assets you do not want to waste unnecessarily. If you activate them, you risk losing them. So, you only do so, when really necessary. This contrasts with disposable agents, which you can activate easily and permanently.

Britain’s spy agency, MI5, has been monitoring the threat posed within the UK by Iranian assets. The recently killed Iranian supreme leader, Ali Khamenei, previously warned that any countries targeting Iran would face dire consequences. The template for how sleeper cells could operate was established by the terror group ISIS a decade ago during the wars in Iraq and Syria.

It’s a decentralised model, almost a franchise, where individuals can commit murder and cloak their action with whatever branding they choose. Therefore, Harakat Ashab al-Yamin al-Islamiya may not be a centralised, hierarchical organisation but that works to its advantage. It’s a loose network of dormant operatives who can strike when they get the green light from Teheran.

How will Europe’s security agencies respond in the months ahead? Krieg believes they will be pre-emptive, rather than reactive:

They will increase surveillance on likely actors, harden likely targets, disrupt reconnaissance, use arrests and prosecutions where they can, and work closely with foreign partners.

The European Union’s central criminal intelligence agency, Europol, has already warned that Iranian networks and individuals pose an “elevated threat” of terrorism across the continent. Right now, those in charge of protecting the public in the UK and Europe are investigating the veracity, reach, and potential risk posed by Harakat Ashab al-Yamin al-Islamiya. The fear is that Iran is about to instigate bloodshed and violence on western streets.