China India Japan Korea Southeast Asia Economy Politics
Home› Security› Feature
Security · Exclusive

Iran's covert playbook: from state agents to hired criminals

Iran's covert playbook: from state agents to hired criminals
Security · 2026
Photo · Huang Wei for Asian Examiner
By Huang Wei Security & Defense Oct 21, 2026 4 min read

British Prime Minister Andy Burnham has stated that a suspected terror plot targeting RAF Fairford in Gloucestershire was “almost certainly” directed by Iran. The allegation has refocused attention on how Tehran projects power beyond its borders, a question that resonates across the Indo-Pacific as well.

The case follows the charging of two Iranians in early October in connection with an alleged plot against Jewish institutions in Manchester. According to authorities, the suspects were in contact with an individual believed to be in Iran. While these investigations are ongoing, they fit a pattern that stretches back decades.

From Berlin to Brussels: a history of state-directed violence

Since the Islamic Republic’s establishment in 1979, Iranian operations abroad have primarily targeted political opponents, dissidents, and perceived enemies of the regime in Tehran. Throughout the 1980s and 1990s, Iranian opposition figures were assassinated or attacked worldwide. One of the most significant incidents was the 1992 killing of four Iranian opposition figures at a Berlin restaurant.

A German court later concluded that senior Iranian leaders, including then-Supreme Leader Ayatollah Ali Khamenei, had ordered the killings. That ruling triggered a diplomatic crisis with several European states and forced Tehran to recalibrate its approach. In subsequent years, Iran leaned more on surveillance, espionage, infiltration of opposition groups, and disinformation campaigns. But assassinations and terrorism never fully disappeared from its toolbox.

Diplomatic cover has also played a key role. In 2021, Iranian diplomat Assadollah Assadi was convicted in Belgium for plotting a bombing against an Iranian opposition gathering in France. The case underscored how embassies and diplomatic missions can serve dual functions, a tactic that has been documented across multiple regions.

The rise of criminal intermediaries

Over the past two decades, a notable shift has occurred. Rather than relying solely on intelligence officers or diplomats, Iran has increasingly turned to local criminal networks to carry out surveillance, intimidation, or attacks abroad. This approach offers several advantages: criminals understand local environments, have access to illicit markets, and can operate without the same scrutiny as foreign agents.

It also provides plausible deniability. Even when investigators identify the immediate perpetrators, linking them directly to Iranian state institutions is often difficult. And criminal networks are frequently cheaper and more flexible than deploying trained officers from Iran itself.

Examples include the 2015 assassination of Iranian dissident Mohammad Reza Kolahi in the Netherlands, for which a key figure in the European drug trade, Naoufal Fassih, was convicted of hiring hitmen. Dutch intelligence cited “strong indications that Iran was involved.” Similarly, Turkey-based drug trafficker Naji Ibrahim Sharifi Zindashti and his network were implicated in the 2017 Istanbul killing of media executive Saeed Karimian and the 2019 murder of cybersecurity defector Masoud Vardanjani.

This model blurs the line between state activity, organized crime, and political violence. It also reflects a broader trend in which state actors outsource sensitive operations to non-state partners, a dynamic that has implications for security agencies worldwide, including in Asia.

What is striking about the Manchester and RAF Fairford cases is that, in both instances, Iran is alleged to have used individuals with Iranian backgrounds residing in the UK. If proven, this would suggest that Iranian intelligence retains recruitment channels and the ability to direct individuals abroad, despite setbacks in recent conflicts with Israel and the United States.

These cases point to an Iranian intelligence apparatus that, although weakened, continues to adapt its recruitment methods. The use of local proxies and criminal networks is not unique to Iran, but Tehran has perfected a playbook that allows it to strike enemies while maintaining a degree of separation. For observers in the Indo-Pacific, where Iran has also sought to expand its influence, the lessons are clear: the threat is not always state-uniformed, and the hidden hands may be hired guns.

More from this story

Next article · Don't miss

Wartime memory reveals limits of China-Russia partnership

China and Russia have coordinated WWII commemorations to bolster their 'no-limits' partnership, but their historical narratives diverge sharply. Beijing increasingly highlights wartime cooperation with Washington, diluting the Moscow-centric memory alliance.

Read the story →
Wartime memory reveals limits of China-Russia partnership