European security agencies are investigating a string of coordinated attacks targeting Jewish sites across the continent, with officials suspecting the involvement of Iran-linked networks operating through
proxies and front groups.
Authorities say the attacks, ranging from fire bombings to attempted bombings, appear to be part of a broader retaliation linked to the ongoing conflict in the Middle East. While no government has formally attributed the incidents to Tehran, multiple European and US officials believe Iranian operatives may be directing the campaign from behind the scenes, The Wall Street Journal reported.
According to investigators, suspected Iranian agents have been recruiting individuals online to carry out attacks on synagogues, Jewish schools and businesses linked to Israel. The operatives are believed to be working under the cover of a previously unknown group calling itself the Islamic Movement of the Righteous Companions.
European intelligence officials say the group was not on their radar before early March, raising suspicions about its authenticity. Analysts believe it may be a front designed to obscure the real masterminds.
“This is about plausible deniability,” said counterterrorism expert Julian Lanchès of the International Centre for Counter-Terrorism. “It’s an effective model. We can likely expect more attacks.”
A Coordinated Pattern of Attacks
Since early March, nearly a dozen attacks or attempted attacks have been reported across Western Europe.
In Belgium’s Antwerp, a car was torched in the Jewish district, while in London, ambulances belonging to a Jewish emergency service were set on fire. Earlier incidents included fire bombings of synagogues and a Jewish school in Belgium and the Netherlands.
Dutch authorities said they foiled a potentially major attack on a synagogue in Heemstede after discovering multiple explosive devices. Several suspects have been arrested across countries, including individuals believed to have been acting on behalf of foreign handlers.
The attacks have been accompanied by a coordinated online campaign. Videos of the incidents have been circulated on pro-Iranian social media channels, sometimes even before the attacks took place, suggesting a level of planning and central direction, the WSJ report said.
In one message posted on March 16, the group urged residents of the European Union to distance themselves “immediately from all American and Zionist interests and everything connected to them,” signalling a clear ideological motive.
Use of Proxies and Digital Recruitment
Security officials say the suspected network reflects a familiar pattern in Iran’s overseas operations, using proxies to conduct deniable attacks.
Iran has long relied on criminal networks and loosely affiliated operatives abroad. What appears new, however, is the structured branding of attacks under a single name, combined with digital recruitment methods.
Investigators believe individuals are being recruited through online platforms and messaging apps, then directed to carry out specific acts of violence. The group’s branding, including its logo and messaging, bears similarities to those used by Iran’s Islamic Revolutionary Guard Corps and allied groups.
Some officials say the group’s materials may have been hastily assembled to create the appearance of a cohesive organisation. Inconsistencies, including misspellings and exaggerated claims, have further fuelled doubts about its authenticity.
Escalation After Leadership Strikes
The suspected campaign comes in the wake of escalating tensions following US and Israeli strikes on Iran, including the killing of top leadership figures.
In a statement after the strikes, the IRGC warned that its adversaries “will no longer be safe anywhere in the world, not even in their own homes”, a message now being closely examined by European agencies in light of the attacks.
The pattern also mirrors tactics used by other state actors. European officials note similarities with Russian sabotage operations following the invasion of Ukraine, where covert networks relied on local recruits, often unaware of the broader geopolitical context.
Widening Security Concerns
The impact of the attacks has been immediate and far-reaching. Jewish communities across Europe have stepped up security, while some Israeli diplomats and staff at Jewish organisations have shifted to remote working arrangements due to safety concerns.
Israel has also issued a global advisory warning its citizens of heightened risks abroad, citing the attacks in Europe and warning that Iran may “intensify its efforts to carry out attacks abroad against Israeli and Jewish targets”.
Iran-linked messaging has also attempted to widen the threat perception. The intelligence arm of the IRGC, in communications cited by investigators, urged civilians to assist in identifying targets. “We are forced to identify and target the Americans,” one such message said. “It is your Islamic duty to accurately report the hiding places of American terrorists.”
Pre-Positioned Networks And Expanding Reach
Security officials believe the recent wave of attacks may be drawing on networks that have been quietly built over time.
In recent years, Iran’s Quds Force—the external operations arm of the IRGC—has been accused of cultivating links with organised crime groups, migrant networks and militant affiliates across Europe. These networks, officials say, may have been activated following the latest escalation.
Arrests in several countries have uncovered weapons caches, surveillance material and lists of potential targets, including Jewish institutions and individuals linked to Israeli organisations.
Beyond Europe, similar plots have been disrupted in other regions. Authorities in Azerbaijan recently foiled a suspected attack targeting energy infrastructure and Jewish-linked sites, while arrests of Iran-linked operatives have also been reported in parts of the Middle East.
A Multi-Theatre Campaign
Taken together, officials say the incidents point to a broader, multi-theatre campaign targeting Israeli, Jewish and Western interests.
While definitive attribution remains elusive, the convergence of tactics, messaging and timing has strengthened suspicions of Iranian involvement.
For now, European security agencies remain on high alert, warning that the threat is ongoing and could escalate further. As Lanchès cautioned, the model itself may be the biggest concern: “We can likely expect more attacks.”
