'It has never been worse': Iran revenge campaign across Europe

2026-03-24 - 11:36

Four ambulances belonging to Hatzalah (the Jewish emergency rescue organization) were set on fire overnight Sunday near a synagogue in Golders Green in London. In the past two weeks, an explosion rocked a synagogue in Belgium, a synagogue was set ablaze in the Netherlands, and explosive devices were attached to a Jewish school in Amsterdam. Prof. Magnus Ranstorp, one of Europe's leading terrorism researchers and research director of the Center for Asymmetric Threat Studies at the Swedish Defense University, is not surprised. "It has never been worse," he said. "We are in the most complex and dangerous situation the continent has ever experienced in terms of Iranian terrorist activity – and we are only at the beginning." According to Ranstorp, the Islamic Revolutionary Guard Corps operates across Europe through three main methods. The first involves direct agents – usually of Afghan origin, though also Iranians and nationals of other countries – who are infiltrated into the continent as migrants and blend into the population. They lead entirely normal lives but remain on standby to act on Iran's orders. Ranstorp cited a case in Sweden in which two sleeper agents had plotted to assassinate the head of the Jewish Council and two other public figures. The second method involves proxy organizations, chief among them Hezbollah. "They are particularly active in Germany," Ranstorp said. "There are Shia Lebanese who arrived there many years ago, some of whom already hold German passports." These networks are primarily engaged in drug trafficking and money laundering, but he warned that is only the surface. "Most of the focus is on smuggling and laundering, but now, under pressure, they are likely to pivot toward terrorism as well." Police forces in Rotterdam (Photo: Reuters) The third method – which appears to be gaining momentum – is the recruitment of local criminals and intermediaries, sometimes through transit countries such as Turkey. "The approach is to identify young criminals, sometimes teenagers aged 14 to 16 from struggling families or with criminal backgrounds, and pay them to attack a Jewish or Israeli building or symbol," Ranstorp explained. 157 terrorist operations According to a recent review by Dr. Matthew Levitt, 157 Iranian terrorist operations have been carried out in the West over the past five years. More than half were executed by agents trained in Iran and sent directly from Tehran. An additional 55 attacks were carried out by proxy operatives, and 22 by recruited criminals – though the pace of attacks of the latter type is growing. One of the most prominent examples of the third method is the Swedish Foxtrot criminal network. At its head is Rawa Majid, a Swedish citizen of Kurdish origin who fled to Iran and fell into the hands of the Revolutionary Guards. "They told him, 'You work with us, or you go to prison,'" Ranstorp recounted. "He chose to work." Majid runs a criminal network from Iran, operating in Stockholm and other parts of Scandinavia. He and his operatives transmit instructions via encrypted digital platforms, identify targets, and attach a price to each. "It is almost like a public billboard with a price list for whoever carries out the crime," Ranstorp said. "Any criminal in those encrypted groups can simply pick a mission." Prof. Magnus Ranstorp Targeting embassies The Foxtrot network, according to Ranstorp, was behind attacks on Israeli embassies in Denmark and Sweden, as well as an attack on an Elbit Systems factory in Gothenburg, carried out by workers aged 14 to 15. "Not high-quality attacks," he acknowledged, "but they generate constant pressure, disrupt the normal work routine, and force the adoption of heightened security arrangements that impair day-to-day operations." What distinguishes the current wave is also a calculated psychological dimension. The group Harakat Ashab al-Yamin (an Iran-linked terrorist group), which claimed responsibility for the arson in London overnight and for the attacks in Belgium and the Netherlands in recent weeks, uses Quranic terminology and documents its activities on video. "They know the Jewish community is under intense pressure and are deliberately amplifying it," Ranstorp said. "The goal is to make life hell for local Israelis and Jews." Unlike the norm, the group also claims public responsibility for its attacks – an unusual step for Iran and Hezbollah. In the broader picture Ranstorp paints, this represents a response to Israel's strategic actions in recent times. "The sleeper cells are waking up, and there is intense activity to generate revenge attacks. The gloves are off on all sides." Belgian military personnel armed with FN SCAR assault rifles stand guard outside a synagogue in central Antwerp as part of Belgium's reinforced security measures established at Jewish schools and synagogues, on March 23, 2026 (Photo: JOHN THYS / AFP) Alongside the deep concern, Ranstorp sees an opportunity in the current situation. "When cells wake up and emerge from the shadows, it becomes possible to identify and eliminate them." He said European intelligence services must shift to offense, monitor mosques across Europe known to be under Iranian control, and examine the activity of Iranian intelligence operatives active in embassies. "This is not like al-Qaida – it is very focused: their targets are Israelis, Jewish communities, and American targets. The attacks will not happen in the middle of the street; they will happen in very specific places, and we need to prepare for this with the utmost seriousness. The question is not whether someone is planning something – it is who is planning something, and whether they can be caught before carrying out a terrorist attack."