April 17, 2026

SHARE |

Iran War Exacerbates the Terrorist Threat Landscape in Europe

AP Photo/Alberto Pezzali

The ongoing war in Iran is a disruptive threat multiplier for Europe’s current terrorism landscape. Rather than generating clear-cut, attributable plots, actors affiliated with the Iranian regime are intentionally cultivating an asymmetric grey-zone attack dynamic characterized by ambiguity. This tactical approach mirrors the two foundational conditions of terrorism — intent and opportunity. It is deliberately exploiting Europe’s relatively permissive security environment, carried out by both fanatic and opportunistic perpetrators, some with a petty criminal track record, focusing on soft targets of symbolic value. This aims to generate an outsized political effect, with the potential to leverage even smaller operations to achieve larger, more profound impacts.

Since Operation Epic Fury began on February 28, several incidents across Europe have illustrated the current Shia-motivated terrorist threat matrix. Particularly, Jewish infrastructure has become a target for these attackers: in Liège on March 9, an explosion hit a synagogue; Rotterdam’s synagogue was burned on March 13; an Amsterdam Jewish school was bombed the next day. U.S.-linked sites were also targeted — seemingly tied to the ongoing U.S. war with Iran. Near the U.S. embassy in Oslo, an improvised explosive device (IED) blast occurred on March 8, followed by a foiled Bank of America bombing plot in Paris later that month. In this case, minors were digitally recruited and allegedly paid €500–1,000 for the assault, which appeared amateurish in nature. This is just an example of a well-established pattern of opportunistic recruitment of low-level criminals by Iran and Russia in their hybrid activities in Europe.

During an arson assault on a Jewish medical charity service in London on March 23, four ambulances were torched near Golders Green synagogue. This case embodies the prevailing logic of Iran-linked attacks. Even though there were no fatalities, it reflects the symbolism and logic of attacks in the wake of the Iran war: striking Jewish emergency services with minimal risk and makeshift logistics to create psychological insecurity and signal that Jewish targets outside the Middle East will also be included in retaliatory operations. On April 16, Ashab al-Yamin, an Iran-linked group, claimed that it attacked the Israeli embassy in London with drones carrying "radioactive and dangerous carcinogenic materials.” However, it was not immediately clear how credible the claim was at the time of writing.

A recent swarm assault — where multiple assailants attack a target in quick succession — targeting the Israeli consulate in Istanbul on April 7, matches this pattern. The three attackers — including a religiously motivated individual with alleged affiliations to an unknown extremist network and two brothers with prior criminal records — were stopped outside Yapi Kredi Plaza by Turkish Police, prompting the assailants to open fire outside the consulate. A clear attribution to a larger state-affiliated structure has not yet been made, but Turkish media speculated the attackers were connected to the Islamic State (IS). Despite the absence of a claim of responsibility, the attack happened during a series of Iran-linked attacks against similar targets across Europe. If this attack is indeed connected to Iran, as many experts believe, this suggests that Iran’s hybrid tactics continue to evolve, allowing plotters and perpetrators to extend their asymmetric reach into Türkiye — a Sunni-dominated state and strong regional stakeholder — without committing major resources. Generally, hybrid and external operations tend to be ambiguous in attribution, hypothetically rendering any counter-response a challenge.

Three determining factors underpin the course of the current Iran-linked violence in Europe. First, the Iran conflict unifies transnational mobilization. The war consolidates grievance and victimhood narratives across otherwise disparate actors ranging from state-linked proxies or criminal intermediaries to self-radicalized individuals, creating a multi-vector threat environment. Second, it incentivizes asymmetry. Direct attacks on U.S. and Israeli targets significantly entail the risk of escalation and robust retaliation against the Iranian regime. Europe thus becomes an extended conflict space, a proxy battlefield where “unattributable” attacks on Jewish institutions, U.S.-linked firms, or diplomatic sites serve as warning signals, without a greater risk of immediate responses against Iran. Third, outsourcing low-level operations allows Iran to strike in locations where it has little to no operatives, generating plausible deniability. Recent cases show Iran’s growing reliance on intermediaries with limited ideological commitment or tactical expertise, including minors and petty criminals motivated by cash rather than defending the Islamic Revolution. This is a tactic that Russia often utilizes in its hybrid operations across Europe.

Europe is comparably a softer target for terrorism than Israel or the U.S. homeland. Preexisting pro-Iranian support structures in Europe are a major asset for the Islamic regime, further expanding its outreach. The continent hosts a wide range of accessible, symbolically charged sites such as synagogues, Jewish schools, community centers, diaspora organizations, and U.S.-linked commercial entities — potential targets that are difficult to secure comprehensively. Other vulnerable targets include tourist attractions, critical infrastructure such as airports and transport hubs, and hotels and major landmarks. Iran’s Armed Forces spokesperson General Abolfazl Shekarchi’s threat on March 20 to launch attacks on “parks, recreational areas, tourist destinations” worldwide, echoed by the announcement of the Islamic Revolutionary Guard Corps (IRGC) to target “Zionist tourists,” is aligned with low-threshold disruptive tactics and a high degree of “implausible” deniability. While they may appear contradictory at first glance, overtly declared threats can still coincide with covert, unattributable attacks.

Pro-Iranian networks drawing from ideological supporters among diaspora, radicalized teenagers, and even petty criminals form an inconspicuous facilitation web across Europe. At the epicenter of these structures, Iran’s IRGC-Quds Force pulls strings through sub-conventional proxies, enabling deniable hits on soft targets like synagogues or tourist spots, sparing Tehran direct blame and possible retaliation. Undoubtedly, Lebanese Hezbollah stands out as a significant facilitator of Iran-related terrorist violence in Europe. The terrorist organization has a grim track record of striking Israeli and Western civilians, from embassies to tourists. Other relevant terrorist structures like Hamas, Palestinian Islamic Jihad, Iraqi Shi’a militias like Kata’ib Hezbollah or Asa’ib Ahl al-Haqq, and even the Houthis add breadth to this versatile proxy ecosystem.

However, none of these actors has launched operations in the last seven weeks. Instead, Harakat Ashab al-Yamin al-Islamia (HAYI), a mysterious group, has claimed responsibility for synagogue arsons in Liège, London, and Antwerp, and plots in Greece, France, and the Netherlands. Almost all of which were carried out using low-tech improvised explosive devices (IEDs). Interestingly, there is no credible intelligence or traceable roots of HAYI activities before March 2026. According to European authorities talking to the Wall Street Journal, HAYI may be a front created by Iranian intelligence to claim attacks it has orchestrated itself to obfuscate direct involvement. However, the roots and authenticity of the group remain unclear.

Since the onset of the Iran War, Europe has been confronted by a pattern of low-intensity attacks, forcing a pivot from focus on small and major coordinated attack plots, primarily by Salafi-Jihadists, to relentless vigilance over synagogues, U.S. sites, and crowded public spaces. A near-term risk assessment for the European threat landscape must therefore focus on smaller-scale symbolic strikes, as well as Iranian state-sponsored terrorism through proxy actors. The war in Iran is catalyzing both European counterterrorism efforts, which increasingly focus on hybrid threats. For security authorities and political decision-makers, it is less about the next coordinated attack scheme and increasingly about strengthening European cities against the slow poison of hybrid operations: diffusion, deniability, and fear as the true weapon — especially as much of the focus on hybrid threats on the continent has been on Russia.

Dr. Nicolas Stockhammer is a Senior Research Fellow at The Soufan Center, focusing on European counterterrorism strategy, youth radicalization, and the role that technology and social media play in violent extremist networks. He also leads the Research Cluster ‘Counter-Terrorism, Countering Violent Extremism and Intelligence’ in the Department of Security Studies at Danube University Krems in Austria.