NATO has issued an unusually blunt warning over what it describes as Tehran’s “surge in malign activity” across Europe, including cyber-intrusions, physical surveillance, and threats to dissidents.
The alliance’s senior intelligence officials say the regime in Tehran has broadened its operations to reach far beyond its borders, targeting Iranian nationals in exile and Western critics with a renewed sense of impunity.
The revelations, confirmed by senior NATO diplomats and US intelligence sources, have triggered an urgent reassessment of security protocols in several European capitals.
At the heart of the concern is Iran’s elite Islamic Revolutionary Guard Corps (IRGC), which Western agencies say has significantly stepped up covert operations on European soil—some involving direct threats of violence against political opponents of the regime.
Speaking from NATO headquarters in Brussels earlier this week, a senior alliance official, who declined to be named due to the sensitivity of the matter, said: “We are witnessing a more aggressive pattern of Iranian behaviour, not only in the Middle East but increasingly across the West. This includes cyber operations against infrastructure, as well as intelligence gathering directed at dissident communities.”
While Tehran has long maintained an intelligence footprint abroad, the scale and brazenness of recent activities has raised eyebrows among Western security officials. In Germany, France, the UK, and the Netherlands, security services have recorded a sharp increase in attempted cyber-intrusions into government servers and private networks associated with Iranian expatriate groups.
British officials at GCHQ have privately described the attempted cyberattacks as “persistent and technically sophisticated,” with some targeting communications between MPs and exiled Iranian democracy activists. “There’s a clear effort to map and disrupt diaspora networks,” one security source said.
In parallel, physical surveillance and intimidation have intensified. Several Iranian exiles in Europe, including journalists and opposition figures, have reported being followed or approached by unknown individuals. In one case, German federal police are said to be investigating an incident in Berlin in which two suspected Iranian operatives were caught photographing the home of a prominent critic of the Iranian regime.
Such tactics are not new, but their frequency and coordination suggest a new directive from Tehran’s security apparatus. US officials point to a pattern: as domestic unrest within Iran grows and international sanctions bite deeper, the regime appears increasingly determined to neutralise perceived threats abroad.
“It’s part of a playbook we’ve seen before,” said a US Department of State official. “When the regime feels vulnerable at home, it lashes out overseas. Europe is now firmly in the crosshairs.”
Washington has already taken steps in response. Earlier this month, the US Treasury Department imposed fresh sanctions on senior IRGC members believed to be involved in orchestrating extraterritorial operations. A joint statement with the European External Action Service (EEAS) warned Iran that “acts of intimidation, harassment or targeting of individuals beyond its borders will not go unanswered.”
But Europe’s response has not been uniform. While the UK has designated the IRGC as a terrorist organisation, several EU member states have resisted taking similar steps, citing diplomatic fallout and fears over regional escalation. The European Parliament passed a symbolic resolution last year urging the EU to list the IRGC, but the European Commission has so far declined to act, pending a formal legal opinion.
This hesitance is drawing criticism. “Europe cannot afford to be naïve. If we allow Iranian agents to operate with impunity in our cities, then we are no longer serious about defending our values—or our citizens,” said one Polish MEP.
Indeed, some of Iran’s targets are EU citizens of Iranian origin. Masih Alinejad, a high-profile Iranian-American journalist and women’s rights campaigner, was the subject of a foiled kidnapping plot in 2021 that US officials traced to Iranian intelligence. European security agencies now fear similar plots may be underway on the continent.
France’s domestic security service, DGSI, has reportedly upgraded threat levels for several Iranian dissidents in Paris, while Belgium—already rattled by a 2020 plot to bomb an Iranian opposition rally outside Brussels—has quietly stepped up counter-intelligence operations.
Iran has officially denied all allegations, calling them “baseless propaganda” designed to sabotage ongoing diplomatic efforts over its nuclear programme. But analysts say there is little doubt as to the origin of the threat. “Iran’s fingerprints are all over this,” said Dr. Behnam Taleblu, senior fellow at the Foundation for Defense of Democracies. “The regime is betting that Europe will remain too divided or distracted to mount a unified response.”
That bet may not be wrong. With the war in Ukraine and growing concerns over China, European intelligence agencies are stretched. Still, many see Iran’s actions as testing not just security resilience, but political will. The longer European governments delay a coordinated approach, the more emboldened Tehran may become.
There are now renewed calls for Brussels to adopt a common sanctions framework targeting individuals and networks tied to extraterritorial repression. A confidential draft report prepared for the European Council, urges the creation of a “rapid-response mechanism” to threats against dissidents from authoritarian regimes—including Iran, Russia, and China.
Whether such a mechanism materialises remains to be seen. But for now, Iran’s reach is growing—and Europe’s security apparatus must catch up fast. As one NATO diplomat warned, “This is no longer a Middle East problem. It is happening here, in our capitals, right under our noses.”
