Six-minute read
The cyber sabotage of hundreds of French supermarkets is the latest warning that Tehran’s operations in Europe have moved far beyond surveillance of dissidents. Years of arrests, sanctions and diplomatic protests have not ended the threat.
Something changed in France on the night of October 11.
Attackers did not steal government secrets or deface a website. They remotely manipulated refrigeration systems at more than 700 supermarkets. Food spoiled. Equipment was damaged. Fires broke out. Losses ran into tens of millions of euros.
On November 9, the French government formally attributed the operation to Iran, saying it had been carried out by Shahid Kaveh, a cyber offensive unit affiliated with the Islamic Revolutionary Guard Corps. Paris described it as unprecedented: the first cyber campaign conducted purely for sabotage on French territory.
The attack was digital, but its consequences were physical.
It also raises a larger question that European governments have been confronting for years: how many incidents must occur before a succession of Iranian-linked operations is treated as a strategic security problem rather than a series of separate cases?
France is hardly alone.
European governments have investigated or prosecuted cases involving assassination plots, surveillance of dissidents, attempted bombings, cyberattacks, arson, intimidation of journalists and the use of organized criminal networks. The targets have ranged from Iranian opposition figures to Jewish communities, media organizations and military facilities.
In light of Hamid Noury's release today, it's crucial to revisit the endless cycle of Western appeasement fueling #Iran's regime #terror and hostage-taking. This loop, starting with Iranian dissidents, now ensnares Western officials and citizens.https://t.co/ieaaOkZb6y
— NCRI-FAC (@iran_policy) June 15, 2024
By June 2026, 24 governments were sufficiently concerned to issue a joint statement condemning what they described as “lethal plotting and other malign actions” by the IRGC Intelligence Organization, the Quds Force and Iran’s Ministry of Intelligence. The statement also pointed to longstanding relationships between Iranian security services and local and international criminal groups.
This was not the first such warning.
In July 2025, 14 countries—including France, Germany, Britain, the Netherlands, Sweden and the United States—said Iranian intelligence services were increasingly collaborating with criminal organizations to kill, kidnap and harass dissidents, journalists, Jewish citizens and current and former officials in Europe and North America.
The vocabulary has become increasingly stark. So has the evidence.
From Villepinte to cyber sabotage
One of the clearest warnings came in 2018. Thousands of people were preparing to attend the annual gathering of the National Council of Resistance of Iran at Villepinte, outside Paris, when European authorities disrupted a bombing plot against the event.
The case became particularly significant because Assadollah Assadi, an Iranian diplomat accredited to the embassy in Vienna, was prosecuted in Belgium. A Belgian court convicted him in 2021 and sentenced him to 20 years in prison for his role in the plot. The case provided something more substantial than political accusation: a judicially established example in which an Iranian diplomat was involved in preparations for a terrorist attack on European soil.
"Washington was prepared to provide a financial and #diplomatic lifeline; however, Tehran's regime lacked both the will and the capacity to play along. Because it is too weak and fragile to accept it," @MehdiOghbai writes.https://t.co/6R3QiV6hSS
— NCRI-FAC (@iran_policy) July 14, 2026
That should have transformed the European debate over Iranian state activity. Instead, the pattern continued.
Dutch intelligence said in 2019 that it had strong indications of Iranian involvement in the killings of two Iranian opponents in the Netherlands. Denmark prosecuted a Norwegian-Iranian man for gathering information linked to a plot against an Iranian Arab opposition figure. Sweden convicted a man who had collected intelligence on Ahwazi dissidents across several European countries. Albania expelled Iranian diplomats after uncovering what its authorities described as operations against members of the Iranian opposition based there.
The methods evolved, but the underlying model remained recognizable: intelligence collection, intermediaries, covert networks and deniable operatives.
More recently, European security services have warned of a further development—the outsourcing of operations to organized crime.
Britain has said Iranian intelligence services increasingly use criminal gangs for hostile activities abroad, providing Tehran with greater deniability and a broader pool of operatives. London sanctioned the Sweden-based Foxtrot criminal network in 2025 over attacks allegedly carried out on behalf of Iran.
This is an important evolution. A state does not need to dispatch an intelligence officer to every operation if it can recruit criminals, proxies or local intermediaries to do the work.
"Once an internal oppressor, the clerical dictatorship in Iran has now become a direct menace to international commerce, #energy security and the economic well-being of billions worldwide," writes @MehdiOghbai.https://t.co/tEMs1wu4kl
— NCRI-FAC (@iran_policy) April 23, 2026
A network, not isolated incidents
Examining each case separately can obscure what European governments increasingly describe as a networked threat.
The United States provided another glimpse of its scale on November 10.
Federal prosecutors unsealed an indictment accusing three Iranian-backed operatives of involvement in nearly 20 terrorist attacks and attempted attacks across Europe and the United States. Prosecutors alleged that the network included IRGC-linked figures and used intermediaries and criminal associates to organize attacks.
Among the allegations was a September 2026 plot against RAF Fairford in Britain, where American military personnel and aircraft were stationed. The indictment alleges that operatives arranged surveillance of the base, obtained vans and fuel, and sought materials that could be used in an attack.
Britain had already concluded that the Fairford incident was highly likely to have been coordinated in Iran and “almost certainly” directed by the IRGC. A joint declaration by more than 30 governments and the EU subsequently condemned Iranian-linked lethal plotting, arson, sabotage, cyberattacks and other hybrid activity.
The French supermarket attack now adds another layer.
Cyber operations let Tehran-linked actors reach civilian infrastructure without sending an operative to the scene. France had already attributed previous Iranian cyber activity to attacks against Charlie Hebdo and interference connected to the 2024 Paris Olympics. The latest operation crossed another threshold by deliberately causing physical damage on a large scale.
Timeline of Iran’s Opposition Exposing the Regime’s Terror Networks & Ballistic Missile Projectshttps://t.co/WS6gUzrbTV
— NCRI-FAC (@iran_policy) April 19, 2023
Taken together, these cases describe something broader than cybercrime or conventional espionage. They describe a toolbox.
That broader posture has also been articulated at the highest level of the Iranian leadership. On October 31, the regime’s Supreme Leader, Mojtaba Khamenei, told senior military commanders that “any level and type of enemy threat must receive an immediate, effective response without geographical limitation.” He also ordered Iran’s military target database to be expanded so that all American and Israeli “physical and non-physical assets” would fall within the armed forces’ reach. The remarks were framed as a doctrine of “maximum deterrence,” but they also point to an explicitly wider geographical conception of confrontation—one that sits uneasily alongside Europe’s growing record of Iranian-linked covert, cyber and proxy operations beyond the Middle East.
Europe has responded—but has it deterred?
European governments have not been passive.
They have arrested suspects, prosecuted operatives, expelled diplomats, frozen assets and imposed sanctions. In February 2026, the European Union formally placed the IRGC on its terrorist list, freezing its assets in member states and prohibiting EU operators from making funds available to it.
France says it will seek further European sanctions after the latest cyberattack.
Britain has summoned Iranian diplomats, sanctioned networks and tightened its legal framework against foreign state threats. In July, after what London described as continued Iranian use of criminal networks and proxies, the Foreign Office said that repeated warnings had failed to stop the activity and that Iran had instead sought to intensify it.
That last point goes to the heart of the problem.
"Western countries have long operated under the assumption that isolating or restricting the organized #IranianResistance—the movement the regime identifies as its primary internal threat—is a low-cost concession to preserve a fragile regional equilibrium," @MasumehBolurchi…
— NCRI-FAC (@iran_policy) June 26, 2026
Sanctions can freeze assets. Arrests can dismantle particular cells. Diplomatic protests can communicate displeasure. None necessarily changes the calculation of a state that concludes the political cost of the next operation will remain manageable.
The record therefore raises a deterrence question, not simply a law-enforcement one.
If each exposed operation produces another condemnation, another summons and another limited sanctions package, while normal diplomatic relations continue largely intact, Tehran may conclude that hostile operations carry costs it can absorb.
The danger is that restraint intended to prevent diplomatic escalation can have the opposite effect: persuading the aggressor that escalation remains affordable.
The question of the embassies
This is where the role of Iran’s diplomatic infrastructure becomes unavoidable.
The scale and persistence of these operations would have been impossible without the logistical, intelligence and operational support provided through Iran’s diplomatic missions in Europe—particularly after the Assadi case, in which an accredited Iranian diplomat was arrested, tried and convicted for his role in a terrorist bombing plot on European soil.
The suspension of a senior #Swedish immigration official raises fresh questions about Tehran’s intelligence operations in Scandinavia—and the political cost of #Europe’s decades-long engagement with the clerical dictatorship.https://t.co/YXxPCuzLNl
— NCRI-FAC (@iran_policy) November 4, 2026
A serving Iranian diplomat was convicted in a bombing conspiracy aimed at a major gathering outside Paris. Albania later expelled Iranian diplomats on national-security grounds before taking the much more dramatic step of terminating diplomatic relations following a destructive Iranian-attributed cyberattack in 2022.
NATO backed Albania’s attribution to Iran and condemned the operation as an attempt to destabilize an ally and disrupt ordinary citizens’ lives.
Albania therefore provides Europe with a rare precedent: a government concluded that the security threat had crossed a threshold at which maintaining normal diplomatic relations was no longer justified.
For those who have closely followed the succession of Iranian intelligence, terrorist and sabotage operations across Europe, the conclusion has become increasingly difficult to avoid: expelling individual operatives or imposing another round of sanctions is no longer enough. They argue that the only effective way to dismantle the diplomatic infrastructure that has repeatedly provided cover, access and logistical support for such activities is to close the Iranian regime’s embassies and expel the networks operating around them.
The Assadi case makes that argument particularly difficult for European governments to dismiss. An accredited Iranian diplomat was arrested, tried, and convicted for his role in a terrorist bombing plot targeting a major opposition gathering on European soil.
There is also a deeper reason why these operations continue. Tehran’s external aggression is not separate from the crises it faces at home; it is one of the ways the regime manages them. For years, the Iranian regime has treated the export of confrontation, instability and pressure abroad as a means of compensating for political weakness, economic failure and growing public discontent inside Iran. External conflict allows the leadership to shift attention, manufacture threats, justify repression and present domestic dissent as part of a wider foreign conspiracy.
For decades, the Iranian Resistance warned about #Iran regime’s export of terrorism arguing for a firm policy to hold regime accountable. But Western governments, diplomats, experts & even columnists, chose to accommodate this threat because they were busy promoting the illusion…
— Dowlat Nowrouzi (@DowlatNowrouzi) October 5, 2026
That dynamic should shape Europe’s response. A regime acting from internal weakness does not necessarily become more cautious when offered concessions. On the contrary, if pressure is followed by diplomatic accommodation, sanctions relief or political restraint without a corresponding behavior change, Tehran can interpret that response as evidence that escalation works. Each concession risks reinforcing the calculation that hostile operations abroad carry limited costs and may even produce political rewards.
Recognizing this weakness is therefore essential. The more serious the regime’s domestic crisis becomes, the greater the incentive to externalize it through intimidation, sabotage, proxy activity and confrontation beyond Iran’s borders. Europe should not answer that pattern with hesitation. It should answer it with consequences strong enough to alter the regime’s calculations: dismantling its operational networks, expelling those involved in intelligence activity, closing diplomatic facilities used to support such operations, and making clear that aggression abroad will increase rather than reduce the pressure on Tehran.
Without that shift, the cycle is likely to continue. The central lesson from years of Iranian operations in Europe is not simply that the regime is willing to take risks. It is that every failure to impose a meaningful cost makes the next risk easier to take.