Iran’s shadow war, out in the open

For years, the Islamic Revolutionary Guard Corps Quds Force’s preferred way of operating abroad was to stay invisible, which is the traditional logic of a foreign intelligence and covert-action service. In practice, that often means building layers between Tehran and the target, recruiting intermediaries, using criminal networks and compartmentalizing the operation.

The person carrying out the attack may know very little, if anything, about who ultimately ordered it, while those giving the order remain several steps removed.

Sponsored Logitech MX Master 3S Review: The Ultimate Productivity Mouse for 2026 See the review →

The so-called “German Network”—three separate units going after dissidents and Jewish community figures across the European continent—illustrates the model: assassination cells linked to Quds Force Unit 840 using deniable operatives, criminal go-betweens and layers of separation designed to keep the Islamic Republic’s fingerprints off the outcome.

That is what makes the attacks on Jewish targets across Europe since March particularly significant.

A group calling itself Harakat Ashab al-Yamin al-Islamiya (or HAYI), publicly claimed responsibility for a series of attacks (at least 17) primarily targeting Jewish communities, but also Iranian journalists and U.S. interests (including an explosion at a synagogue in Liège, Belgium, on March 9; the arson of a synagogue in Rotterdam, The Netherlands, on March 13; and the March 23 arson attack on four Hatzola ambulances in Golders Green, London).

British authorities have gone beyond describing HAYI as merely Iranian-linked: The Foreign Office says members of the Quds Force were behind the organization and “almost certainly directed” its attacks across Europe.

That is the crucial point: According to the British government, HAYI was not simply another independent extremist group but a proxy directed by the Quds Force.

The emergence of HAYI reflects an evolution in how Iran applies its traditional methods rather than a departure from it, the Quds Force remaining behind layers of intermediaries and proxies. What has changed is that HAYI has claimed the violence in public.

That matters because plausible deniability is central to the logic of traditional clandestine operations: The people who carry out the violence may appear to belong to a criminal network or an independent group, while those directing it remain several steps removed.

The same model has recently appeared in other Iranian operations. Mossad and the Israeli Security Agency (Shin Bet) recently disclosed what they said was an Iranian attempt to build an assassination network inside Israel aimed at senior officials. According to the Israeli account, it relied on intermediaries recruited across several countries instead of direct contact between Tehran and those expected to carry out the attacks.

The details differ, but the same operational logic is at work: creating enough distance between the state and the act of violence to complicate attribution while preserving deniability.

That is where HAYI marks a potentially important evolution. The operating model remains familiar—the Quds Force stays behind layers of intermediaries and proxies—but HAYI adds something different. It publicly claims the violence.

The attack, in other words, is no longer meant only to affect its immediate target. The claim of responsibility extends its reach, ensuring that a wider community sees it, talks about it and remembers it. For Jewish communities, fear itself can become part of the operation.

This may be the emerging pattern: Iran’s clandestine apparatus preserves distance from the attack while allowing the attack itself to become an act of open intimidation.

HAYI provides an unusually clear view of how the system can work. According to British authorities, Quds Force members almost certainly directed its attacks across Europe while the group itself publicly claimed responsibility.

The Quds Force does not need to appear at the scene to shape an operation. It can recruit, support, compartmentalize and outsource. That is what a foreign intelligence and covert-action service is built to do. Iran’s shadow war, then, is still run from the shadows. What has changed is that its proxies may no longer keep the violence there.

The hand behind the attack remains difficult to see. The intimidation no longer does.

Get the latest updates in our WhatsApp group.