In the months following the commencement of hostilities between the United States and Iran in February, a series of low-level attacks targeting Jewish and American interests in Europe and North America raised alarms among counterterrorism officials. These incidents, primarily involving arson and small bombings, have prompted concerns about a widening conflict that now threatens Western soil.
Most recently, British authorities arrested five men in connection with a plot near the Royal Air Force base at Fairford, England—a site previously identified by Iran as a “legitimate target.” Although the men were released, counterterrorism experts see this incident as more serious than earlier attacks. British Prime Minister Andy Burnham indicated “strong indications” of Iranian involvement in the conspiracy, and one of those arrested was a British-Iranian national.
Following intelligence about a possible Iran-backed plot, the United States swiftly withdrew all 12 B-1B strategic bombers stationed at the Fairford base. This move, confirmed by U.S. officials on condition of anonymity, underscores the heightened threat perception toward Western military installations involved in strikes against Iran.
Separately, British counterterrorism police charged two Iranian men with preparing explosives and conducting surveillance on Jewish targets in the Manchester area. Authorities allege the suspects were assembling homemade bombs and gathering intelligence for attacks, a continuation of the pattern seen in previous incidents.
Experts describe these operations as part of a “gig economy hybrid model” of warfare, a method involving the recruitment of low-level operatives often unaware of their handlers’ identities. These “disposable agents” are typically recruited through encrypted online platforms and paid with cryptocurrency, thereby shielding higher-level organizers from direct exposure. Counterterrorism consultant Adrian Shtuni noted that this approach originated with Russia and was subsequently adopted by Iran to carry out proxy attacks while limiting diplomatic fallout.
Previous assaults—mainly targeting symbolic locations such as synagogues, Jewish schools, and American institutions—were credited to a front organization linked to Iran’s Islamic Revolutionary Guards Corps (IRGC). These attacks, primarily nighttime arsons that caused superficial damage without casualties, ceased in May after the arrest of an Iraqi suspect in Turkey, who was extradited to the United States on terrorism charges.
The alleged architect behind many of these plots, Mohammad Baqer al-Saadi, was indicted in the U.S. last month. Identified as a senior member of Kataib Hezbollah, an Iranian-backed militia designated as a terrorist organization by Washington, al-Saadi is accused of orchestrating attacks across Europe and North America through a proxy group called Harakat Ashab Al-Yamin al-Islamiya. According to court documents, he transferred cryptocurrency funds to an undercover federal agent to facilitate planned assaults on Jewish facilities in New York, Los Angeles, and Scottsdale, Arizona.
Analysts highlight that operating in Europe presents fewer counterterrorism challenges for Iran-linked groups compared to the United States, where post-9/11 security measures have significantly tightened. Utilizing local recruits not only complicates law enforcement efforts but also aims to aggravate existing societal divisions, including issues related to polarization, integration, and antisemitism.
While some officials, including former U.S. President Donald Trump, have suggested broader Iran involvement in other incidents—such as a foiled attack aboard a FlyDubai flight to Tel Aviv—no concrete evidence has been presented to substantiate claims linking these events directly to Tehran. Israeli Prime Minister Benjamin Netanyahu has alluded to the possibility of jihadist motivations in certain plots, but security specialists caution that definitive proof remains elusive.
European responses to these sporadic attacks have varied, with some countries treating them as terrorist acts and others categorizing them under criminal law. Nonetheless, experts emphasize that these incidents are extensions of the ongoing Middle Eastern conflict, representing an expanded battlefield that incorporates hybrid tactics and proxy actors beyond traditional frontlines.