Witold Stupnicki on suspected Iran-linked sleeper cells emerging across Europe

Witold Stupnicki, ACLED Senior Analyst, Europe & Central Asia said: 

"Since the start of the United States-Israeli strikes on Iran on 28 February, a series of attacks, plots, and espionage arrests, with suspected links to Iran, have occurred across Europe and the South Caucasus. These attacks have targeted Jewish and Israeli communities, US and Western diplomatic and military assets, and critical energy infrastructure.

As of 23 March, ACLED records at least eight such incidents since early 6 March. The earliest came on 6 March, when Azerbaijani authorities dismantled a suspected Islamic Revolutionary Guard Corps-linked cell in Baku accused of plotting attacks on the Israeli embassy, a synagogue, a Jewish community leader, and the Baku-Tbilisi-Ceyhan oil pipeline, which carries crude oil to Israel. 

The same day in London, British police arrested four suspected Iranian operatives in what officials described as a long-running investigation involving surveillance of Jewish sites that pre-dates the US-Israeli strikes on Iran, indicating that networks for attacks in Europe were established before 28 February.

Just two days later, an IED detonated outside the US embassy in Oslo, leading to the arrest of three Norwegian citizens of Iraqi origin in their twenties. 

On 9 March, another explosion damaged a synagogue in Liège, Belgium.

The incidents continued in the Netherlands. On 13 March, an explosion struck a synagogue in Rotterdam, where police later detained four Dutch teenagers. A day later, another blast targeted a Jewish school in Amsterdam. On 16 March, a further explosion hit the office building of a US financial institution in Amsterdam.

On 19 March, two suspected spies, including an Iranian national, were arrested attempting to enter the Faslane nuclear submarine base in the United Kingdom.

Five of the eight known incidents have targeted Jewish institutions. The rest were focused on Western diplomatic and military assets, as well as a financial institution. While some plots appear linked to organized networks, several of the attacks themselves were carried out by locally recruited individuals with no prior terrorism records, complicating attribution and prosecution.

A previously unknown group, which calls itself Harakat Ashab al-Yamin al-Islamia, claimed responsibility for the events in Belgium and the Netherlands. At the same time, several inconsistencies in the claims, linguistic errors, and  misspellings suggest that these actions were not carried out by a professional terrorist organization or directly by Iranian intelligence operatives, while still pointing toward Iranian-linked activity.

Authorities in the Netherlands say Iranian involvement is being explicitly investigated, though no definitive link between Tehran and the attacks has yet been confirmed.

So far, the incidents have caused limited property damage and no fatalities."

For an interview with Witold Stupnicki, contact the ACLED press office, [email protected]. 

ACLED (Armed Conflict Location & Event Data) is a global monitor that collects, analyzes, and maps data on conflict and protest. ACLED provides detailed information to help identify, understand, and track patterns and trends in conflict and crisis situations around the world.