Adrian Shtuni is the CEO of Shtuni Consulting, and Colin P. Clarke is the executive director of the Soufan Center.
The Iranian regime evidently isn’t busy enough. Preoccupied with war at home, it is still keen on exporting terror abroad. Consider the Justice Department’s unsealed complaint against Mohammad Baqer Saad Dawood Al-Saadi. The government alleges that Al-Saadi, a 32-year-old Kata’ib Hezbollah commander, is responsible for several plots and attacks in Europe and North America claimed by Harakat Ashab al-Yamin al-Islamiya (HAYI), a front operating on behalf of the Islamic Revolutionary Guard Corps. He was detained in Turkey while reportedly en route to Moscow and pleaded not guilty last week.
Al-Saadi’s arrest and the surge of HAYI attacks underscore that the West remains a playground for rogue states to launch shadow wars. Russia has been engaging in such tactics for years. Its signature move involves enlisting low-level operatives through Telegram-based “gig economy” jobs. Russian intelligence has reportedly recruited more than 800 Ukrainians for tasks including arson, infrastructure sabotage and espionage in recent years. Similar plots have spread to Britain, Poland, Germany and the Baltics.
Tehran has done much the same and mimicked Moscow’s hybrid approach, using disposable agents, some of them minors, to exact targeted retribution in Western countries. HAYI, Al-Saadi’s alleged terrorist outfit, began operating in March, days after U.S.-Israeli actions against the regime escalated. It has claimed at least 18 attacks in Europe, targeting synagogues, Jewish schools, ambulances and community sites. The group and its supporters have wasted no time flooding established pro-Iranian channels with footage of their attacks, amplifying the terror in real time.
Many of these assaults are straightforwardly antisemitic, meant to intimidate Jews. But the goal is likely greater. The terror, often done by Muslim immigrants, stokes fear among Jews, resentment among Muslims and suspicion in the wider public. The activity deepens existing social fault lines, sows division and destabilizes European societies. It is an unconventional form of terrorism intended to spur unrest that the continent so far seems to treat with kid gloves.
One case is particularly instructive. Three Serbian nationals were convicted in Smederevo in December 2025 for espionage and inciting racial and religious hatred. Their reported behavior included placing pigs’ heads outside nine mosques around Paris, throwing green paint on Jewish sites and littering the French capital with stickers about the Ottomans’ mass killings of Armenian Christians. Court records later confirmed that Russian intelligence had ordered and funded these operations. The explicit aim, according to the verdicts, was to inflame religious and ethnic tensions and destabilize France. Yet the punishment for the three accused: sentences ranging from six to 18 months of house arrest with electronic monitoring. In other words, a slap on the wrist for a foreign-intelligence-directed destabilization operation.
The strategy behind such attacks is to rely on a country’s vulnerabilities. Once an agent lights a fuse, a host country can supply the rest. It’s little wonder, then, that Europol earlier this year warned of such threats on the continent. Political polarization, antisemitism and migrant assimilation, among others, are ripe for manipulation.
“Hybrid threats” — a more benign term than terrorism — ought to be treated with the same level of urgency as jihadism was during the peak of the Islamic State caliphate. That would include prioritizing public awareness campaigns warning at-risk individuals in the diaspora and refugee communities against recruitment. European capitals could strengthen cross-border cooperation between intelligence and law enforcement agencies. Such outfits should also devote more resources to disrupting nodes in networks, on and offline, including any handlers managing low-level agent operations in Europe.
Washington might use such developments to bolster its own defenses against threats on American soil. Al-Saadi, after all, had allegedly attempted to coordinate attacks on a prominent New York City synagogue and Jewish community centers in Los Angeles and Scottsdale, Arizona. It is also a fine opportunity for the U.S. to redouble its cooperation with allies to prevent the next iteration of what Al-Saadi was planning.
Equally important: Rogue states need to know they’ll be punished for hybrid-style aggression. Cyber campaigns to expose recruitment networks would disrupt their efforts, and deplatforming channels used by HAYI and other fronts would slow the spread of propaganda. Crippling sponsoring states with additional sanctions would signal that the West is serious about fighting back while also helping to sever the financial lifelines that support such operations.
Al-Saadi’s arrest might mitigate HAYI’s operational tempo in the short term, but Western capitals shouldn’t expect the strategy to stop. Tehran knows how effective disposable agents are. The attacks will continue until the West’s counterterror strategy improves.
The post Europe is becoming Iran’s playground for terrorism appeared first on Washington Post.
