How Iran Outsources Attacks to Criminal Gangs and Proxies

Key takeaways

• Iran increasingly outsources attacks abroad to criminal gangs, drug traffickers, and teenagers recruited online, which gives it deniability and helps it avoid a direct Western response.
• The model isn’t new: US prosecutors say the IRGC paid $500,000 in 2022 for a plot to kill journalist Masih Alinejad, and the Swedish gang Foxtrot has been sanctioned by the US and UK for Iran-directed attacks in Europe.
• MI5 says it tracked more than 20 potentially lethal Iran-backed plots in a single year, and more than 50 people have been arrested in the UK this year in connection with Iran-linked plots.

What Happened at RAF Fairford?

Early on the morning of September 27, British police arrested five hooded, masked men near RAF Fairford, the Royal Air Force base from which US bombers had been flying strikes on Iran. Officers found gasoline in three white vans and briefly held the men before releasing them on bail while they remained under investigation. A sixth suspect, a 25-year-old British-Iranian dual national, was arrested several days later on suspicion of planning terrorist acts, and the US soon pulled its bombers from the base. Speaking to Parliament, Prime Minister Andy Burnham said a disrupted plot to attack the US bombers was “highly likely” to have originated in Iran under the direction of the country’s  Islamic Revolutionary Guard Corps (IRGC).

Iran denied involvement, and details about the plot remain hazy. But that may have been the point — and part of a growing pattern.

Why Is Iran Outsourcing Attacks to Criminal Gangs?

Iran has been under Western sanctions for decades and, more recently, mired in an on-off war with Israel and the US. Increasingly, and likely to avoid a direct response, the country is outsourcing attacks abroad to criminals, drug traffickers, and even teenagers recruited online. Clara Broekaert, a research analyst at the Soufan Center, a New York-based security think tank, calls the approach “implausibly deniable”: Western governments can be sure who is behind an attack without being able to prove it.

It is a play Iran has already run on American soil. In 2022, the IRGC paid $500,000 to two organized crime leaders to kill Masih Alinejad, an Iranian-American journalist and outspoken critic of Tehran, at her home in Brooklyn. Two years later, according to US prosecutors, the IRGC tasked an Afghan national in Tehran with planning the assassination of then-candidate Donald Trump.

 “I believe, unfortunately, that is going to be our new reality for a while,” Karim Sadjadpour, a senior fellow at the Carnegie Endowment for International Peace, told the One Decision podcast in October. Iran’s regime, he continued, “operates through proxies and cutouts. It hires, oftentimes, criminal gangs to carry out its dirty work, and I think that’s something we should all expect to continue.”

How Iran’s Outsourced Attacks Have Evolved Since 2018

From diplomats to criminal cutouts

For decades, analysts say, Iran mostly relied on its own diplomats and intelligence officers for covert operations on foreign soil. Then, in 2018, a foiled bomb plot at an Iranian opposition rally in Paris led to the arrest and conviction of one of Iran’s diplomats. Since that time, Iran has increasingly turned to hired hands it could disown. In late 2020, the US Department of Justice charged two members of Canada’s Hells Angels motorcycle gang in connection with a for-hire murder plot targeting a defector and his wife in Maryland. A drug lord in Iran, working his international criminal connections, had engaged them for the mission. In Sweden, the Foxtrot network, a gang that trafficks drugs and arms, stands accused of orchestrating a January 2024 grenade attack on the Israeli Embassy in Stockholm on Iran’s behalf. Intelligence officials in Australia have also alleged that the IRGC used a “complex web of proxies” to firebomb a kosher deli in Sydney and a synagogue in Melbourne in 2024. In each case, hired help — cutouts — stood between Tehran and the crime.

Hybrid warfare: recruiting teenagers on Telegram and Snapchat

Iran may also be borrowing from the gray-zone hybrid warfare model that Russia pioneered in attacks across Europe. This approach, according to counterterrorism experts, maintains deniability while staying below the threshold of open conflict, using agents a state can disown. Recruits contacted online receive modest payments to carry out attacks  without knowing who directed them. A wave of arson and bomb attacks on Jewish sites this spring, claimed by a group calling itself Harakat Ashab al-Yamin al-Islamiya (HAYI), relied on young recruits found via Telegram and Snapchat and paid $575 to $1,150 each. This October, a Norwegian teenager recruited through social media by Foxtrot — sanctioned by both the US and UK for Iran-directed attacks in Europe — was sentenced to 20 years for agreeing to shoot an unknown target in Britain for approximately $29,000.

Why deniability appeals to Tehran

For Tehran, the appeal is plain: like Russia, it can pursue state-level aims — eliminating pesky voices of opposition, eroding Western cohesion, and more — while outsourcing the violence to criminals and disposable recruits. A Soufan Center analysis describes it as a way to use “terrorism, criminality, and plausible deniability as tools of great power competition” without crossing into open war. For Western governments, this means playing whack-a-mole with each operation Iran outsources, much as Europe has struggled to counter Russia’s hybrid campaign.

Is Hiring Criminals for Political Violence New?

Governments, including the US’s own, have long resorted to unsavory partnerships to achieve strategic ends. Fearing Axis spies and saboteurs, the Navy’s intelligence branch recruited a Brooklyn mobster and fish-market kingpin during World War II to supply its agents with union cards so they could work on New York’s docks and aboard fishing boats. In the early 1960s, the CIA again turned to the Italian mafia, including Chicago boss Sam Giancana, to help carry out the agency’s plan to kill Cuban leader Fidel Castro.

Perhaps the closest modern precedent for Iran’s model is the infamous Venezuelan-born terrorist Ilich Ramírez Sánchez, better known as Carlos the Jackal. After starting as a Marxist fighting for Palestinian militants, Ramírez Sánchez hired himself out as a contract assassin who bombed and killed across Europe and the Middle East for a shifting list of patrons. In 1974, his lesser-known contemporary, a Palestinian named Sabri al-Banna, founded a hired-gun group called the Fatah Revolutionary Council. Over the next two decades, al-Banna and his men hired themselves out to Iraq, Syria, and Libya and reportedly killed or wounded some 900 people in 20 countries, collecting between $1 million and $3 million per operation.

What’s changed is who does the work and why. Both Ramírez Sánchez and al-Banna were ideologically driven and knew who was paying them. In contrast, Iran’s more purely mercenary recruits typically have little or no ideological affinity with the Iranian revolution; even if they do, they are unlikely to know whose interests they are serving. An operation’s chain of command frequently begins with Iranian state actors, with the IRGC’s Quds Force or the Ministry of Intelligence and Security setting an objective. A second layer of handlers or criminal networks turns the order into a plan. Recruits in Europe, hired digitally, carry it out while the handlers remain in the Middle East. In the plot to kill Alinejad, according to prosecutors, an Iran-based crime boss received targeting information directly from IRGC officials and passed it to another crime boss in Europe, who relayed it to a hitman in Yonkers, New York.

Timeline

How Is the West Responding to Iran’s Proxy Attacks?

After Israel’s 12-day war on Iran in June 2025, more than a dozen Western governments warned of mounting Iranian plots to kill, kidnap, and sow chaos using international criminal groups. By that October, Britain’s MI5 said it had tracked more than 20 potentially lethal Iran-backed plots in a single year, about as many as in the previous three years. The start of the US-Israeli campaign in February led to another surge of attacks. One analysis counted at least 17 attacks on Jewish sites claimed by HAYI, which US prosecutors have linked to the IRGC. This year, more than 50 people in the UK have been arrested in connection with Iran-linked plots and, according to MI5, Tehran is increasingly intent on hitting harder targets, such as military sites.

Western governments have responded with new laws, terrorist listings, and sanctions aimed at Iran and its proxy networks. Britain placed Iran on the “enhanced tier” of a new foreign-influence registration program, and in July used new powers to ban support for the IRGC and HAYI. The European Union also recently listed the IRGC as a terrorist organization, and sanctions now reach some of the mercenary criminal networks themselves. Courts have convicted several Iran-backed plotters, including the Norwegian teenager recruited by Foxtrot and a Danish national jailed in Germany for planning an attack on Jewish leaders. 

These successes, however, illustrate the central challenge of Iran’s outsourced campaign: the people in the dock are mostly the criminal equivalent of Taskrabbits, while the handlers who direct them remain almost entirely out of reach. The head of the IRGC’s counterespionage operations, for example, was charged in the plot to kill Alinejad, sanctioned by both the US and UK, and has never spent a day in prison.

The harder question is what leverage the West has left to deter Iran’s increasing use of cutouts and criminal proxies. The country’s supreme leader was killed in the opening strikes of the war, a US naval blockade has choked its oil exports, and the International Monetary Fund recently forecast that its economy would shrink 7.6 percent this year. Front groups like HAYI, according to Adrian Shtuni, an associate fellow at the International Centre for Counter-Terrorism, allow Iran to mount fast, low-tech attacks that frighten communities, strain security services, and generate propaganda, all while “avoiding thresholds that would provoke unified Western retaliation.” The economics of asymmetric warfare also favor Tehran: deniable attacks carried out by distant proxies are cheap to outsource, while even failed plots force authorities to commit scarce resources to stopping the next one.

Iran “is a deeply ideological revolutionary regime which is prepared to inflict massive suffering on its own population rather than compromise,” Sadjadpour said. “We can increase the cost for its conduct and sharpen the choices it has to make. But, ultimately, my view is that the forty-seven-year cold-hot war between America and Iran is not going to be fully resolved until you have a government in Iran whose ethos, whose identity is not revolutionary ideology, but national interests.”