The war between Iran and the United States and Israel, which began on 28 February 2026 with joint US-Israeli strikes against Iran, has, as could be expected, not remained confined to the Middle East. European security agencies have warned of an increased threat of cyberattacks, terrorism and other activities carried out by Iran or Iran-linked actors.
Since early March, a series of attacks and attempted attacks against Jewish, Israeli, US and Iranian opposition-related targets have attracted attention across Europe. Some have been claimed by the previously little-known pro-Iranian group Harakat Ashab al-Yamin al-Islamiya (HAYI). The International Centre for Counter-Terrorism (ICCT) noted as early as March that the incidents raised questions about possible Iranian involvement, while stressing that proving definitive links remains difficult.
What is particularly noteworthy about Iranian activity is not so much the individual operations themselves, but the way different methods reinforce one another. An isolated act of vandalism, cyberattack or anonymous Telegram post may have limited impact on its own. Combined with online amplification and uncertainty over who is actually behind the activity, however, relatively cheap and simple operations can generate a much greater psychological and political impact.
A front in Europe
Iran has a long history of conducting operations beyond its borders, primarily targeting Iranian dissidents and targets associated with Israel or Jewish communities. The war in the Middle East has heightened concerns that such activities could increase in Europe.
HAYI emerged publicly soon after the war began and claimed responsibility for a series of attacks, mainly against Jewish targets. These included arson attacks and attempted bombings in the United Kingdom, Belgium, France and the Netherlands. In many cases, the methods used were relatively unsophisticated, with local young people carrying out the operations rather than trained agents.
This resembles the broader model of using so-called disposable agents. Locally recruited individuals are paid or persuaded to carry out relatively simple operations, while those organising them remain several intermediaries removed from the actual perpetrators. The ICCT has identified the recruitment of young people for such tasks as one feature of hybrid activity increasingly seen in Europe, whether conducted by Iran or Russia.
Easy to deny
Attributing such operations directly to Tehran is difficult, however, and it is important to distinguish between an operation organised by the Iranian state and an attack carried out by a pro-Iranian group.
Iranian security services have previously been linked to foreign criminal organisations and intermediaries. In June 2026, 24 countries, including Estonia, issued a joint statement condemning Iranian state threats and attacks claimed by HAYI in Europe. The statement specifically named the Islamic Revolutionary Guard Corps Intelligence Organisation, the Quds Force and the Ministry of Intelligence and Security, and described the Iranian security services’ relationships with international and local criminal groups as longstanding.
This does not mean that every attack claimed by HAYI can automatically be regarded as having been ordered by Tehran. Initial assessments left several possibilities open. Western security services have investigated both whether HAYI is a structure linked to Iran’s Islamic Revolutionary Guard Corps and whether it may instead be a network of pro-Iranian actors.
This uncertainty works to Iran’s advantage. There may be several layers between a state institution and the person who ultimately carries out an attack: an intelligence service, an intermediary, an online organisation and, finally, a locally recruited individual. The perpetrator may not even have any significant ideological connection to Iran.
This structure provides what is known as plausible deniability. Iran can benefit from the fear generated by such attacks while making definitive attribution, and consequently the implementation of countermeasures, considerably more difficult.
Cyber operations
The same distinction is necessary when examining cyber operations. Some actors can be linked to Iranian state institutions, while others are Iran-linked or pro-Iranian so-called hacktivists whose actual relationship with Tehran remains unclear.
Since the beginning of the war, the threat posed in cyberspace by both Iranian state cyber actors and pro-Iranian hacktivists has increased. The latter often conduct relatively simple attacks, such as distributed denial-of-service (DDoS) attacks, although Iran has also been linked to more serious operations. In March, for example, Poland thwarted a cyberattack against a nuclear research centre. Traces discovered during the investigation suggested possible Iranian involvement, although Polish authorities cautioned that these could also have been deliberately planted to mislead investigators. In July, an allegedly Iran-linked cyberattack knocked a small British electricity producer offline for four days, although the attack did not threaten the country’s wider power grid.
This pattern illustrates one characteristic of hybrid warfare: the perceived impact of an operation, whether in cyberspace or the physical world, can appear far greater than its actual practical consequences.
Information operations as a force multiplier
The information dimension is therefore not separate from physical and cyber operations. Instead, it acts as a force multiplier for their effects.
HAYI’s activities provide one example. Attacks have been accompanied by online claims of responsibility and videos, allowing relatively minor incidents to be portrayed as part of a much larger campaign. According to a Washington Institute report, the purpose of this model is not merely to cause physical damage, but also to spread fear, burden security services and generate propaganda effects through Telegram and other channels. A physical or cyberattack produces material for an information operation, while the information operation in turn magnifies the perceived significance of the attack.
At the same time, Iran and pro-Iranian actors have conducted a much broader information campaign related to the war. For example, the Institute for Strategic Dialogue (ISD) identified two coordinated pro-Iranian networks on X, BRICKS4CLICKS and Verified4War, whose content received more than one billion views during the first month of the war. The networks spread false and AI-generated content exaggerating Iranian military successes and attacking the United States and Israel. It is important to note, however, that ISD did not find sufficient evidence to attribute these networks directly to Tehran.
Screenshot from the ISD report
Iranian state representatives have also participated directly in the information campaign. According to ISD, posts by Iranian embassies and other official accounts received approximately 900 million views and 22 million likes during the first 50 days of the war. Their communications increasingly moved away from conventional diplomatic language towards memes, provocative humour and visual content.
This creates an information environment in which Iran’s official communications, state-linked actors and much more loosely controlled networks of pro-Iranian accounts can amplify similar narratives without necessarily operating under a single central command.
Exploiting existing divisions
For Iranian information operations to succeed, Europeans do not need to become supporters of the Iranian government.
Existing political divisions can provide useful material. Even before the current war, for example, the Iranian information operation Storm-2035 used accounts posing as residents of Northern Ireland. They promoted Irish reunification while simultaneously posting about Palestine and other politically divisive issues. ISD found that four accounts linked to the operation falsely presented themselves as people living in Belfast.
Screenshot from the ISD report
The aim of such operations is not necessarily to create a directly pro-Iranian audience. Amplifying existing social divisions, undermining trust or inserting narratives favourable to Iran into already existing political debates may be enough.
The war in the Middle East also provides plenty of material for this purpose: civilian casualties, claims about Iranian military successes and failures, and dissatisfaction with US foreign policy more broadly can all be connected to existing political divisions in Europe.
Iran and Russia
Russia does not need to coordinate Iran’s activities in order to benefit from them. Anti-Western narratives spread by Iran, along with the social tensions and disputes they amplify, continuously provide Russian networks with new material. Tehran’s objective may be to build support for its own actions or increase pressure on the United States and Israel, while for Moscow the same content can help deepen distrust of Western countries and divert attention from what is happening in Ukraine.
Cover image: Flickr / Ninara, CC BY 2.0
