Between violent extremism and hostile state activity: Iranian targeting of the UK
9 May 2025
On Saturday, British police arrested eight Iranian nationals in two separate counterterrorism operations, with reports that the plot was targeting the Israeli embassy in the UK. Described as one of the largest and most complex operations in years, the arrests emphasise the evolving nature of the national security threat attributed to Iran and its proxies in the UK, blending information operations, violent extremism and threats to critical infrastructure.
There has been an increasing intersection between the activities of hostile state actors and violent extremists targeting the UK in recent years. The Minister for Security recently revealed that a 48 percent rise in counter-terrorism police investigations involving state threats over the past year, including 20 Iran-backed plots thwarted since 2022. Such activity at the nexus of violent extremism and state-based threats challenges siloed policy responses across these domains.
The challenge posed by Iran comes in the context of a broader range of state actors with a potential interest in targeting the UK. Rather than inventing new disinformation narratives, state actors like Iran, Russia and China often leverage and amplify political divisions or bolster movements that serve their strategic aims. The success of these information operations often relies on the receptiveness of diaspora communities in the UK to gain initial purchase. In the wake of October 7, ISD research has documented how Iran-linked online networks (alongside those of Russia and China) have particularly seized on the post-October 7 context to agitate against liberal democracies and spread antisemitism. This Dispatch examines how these operations are evolving, how UK policy has responded so far and what more could be done.
A multifaceted threat
Iran’s position as a revolutionary theocratic state with global links to Islamist groups situates it at the heart of the ‘hybridisation’ of state and non-state threats. This threat is by no means unique to the UK: evidence points to the collaboration of organised crime networks and Iranian state arms in multiple European countries. Related threats range from hostile influence operations to mobilising targeted hate against specific communities to facilitating politically motivated attacks.
This is not the first time Iran is alleged to have targeted Israeli and Jewish targets in Western countries; last year the Swedish security services accused Iran of being involved in attacks near Israeli embassies in Stockholm and Copenhagen. In April and May 2024, Swedish, French and German police also arrested criminals who were allegedly recruited by Iranian intelligence services for targeted violence. Their alleged victims included Jewish and Israeli targets in Sweden and Germany, as well as Iranian opposition activists. While the recruitment of criminals would be novel, it echoes previous Iranian-directed terrorist attacks in the US, UK, France and the Netherlands. Such targeting patterns stretch back decades. The Argentinian High Court blames Iran for the Hezbollah attacks on the Israeli embassy in Buenos Aires and AMIA Jewish community centre in 1994 and 1992; a charge which Iran denies.
Recent reporting from the Jewish Chronicle has shown how institutions and individuals linked to the Islamic Revolutionary Guard Corps (IRGC) have targeted British Jewish communities. Examples include student groups livestreaming talks from commanders in the IRGC’s Lebas Shakhsi (“plainclothesmen”) secret police on social media. These individuals were quoted as saying that “the era of the Jews will soon be at an end” and called for UK students to join “the beautiful list of soldiers” who would fight and kill Jews in an apocalyptic war.
Just as Iran uses proxy Islamist groups to sow violence and chaos in the Middle East and beyond, it is also targeting UK and western interests through online proxy groups, including hacktivist collectives with ties to Iran-backed militias. Late last year, a group that claims links to the Badr Brigade (an Iran-backed militia in Iraq) circulated a ‘wish list’ of targets in the UK as part of a wider effort known as “OpGB.” In concert with Russia-aligned and backed hacktivist groups, the group sought to disrupt critical infrastructure such as railway systems, as well as assets in the banking, media and defence sectors. Iranian hacktivist groups have previously been successful in penetrating water treatment control systems in the United States, using high-profile hacks to showcase their abilities to disrupt key infrastructure in Western states. One of the most high–profile instances of these cyberattacks was conducted by IRGC-linked ‘Cyber Av3ngers’ in 2023, which resulted in the group penetrating multiple facilities across the US. IRGC-linked hackers similarly launched spear phishing-attacks in the UK targeting diplomats, researchers and journalists in 2024, resulting in the National Cyber Security Centre (NCSC) releasing a joint bulletin with the US. A year prior Iranian hackers impersonated the Royal United Services Institute (RUSI) to infect a US-based think tank with malware.
Understanding Iranian influence operations
Beyond such specific targeting of communities and infrastructure lies a broader campaign of Iranian online influence operations, which has generally been considered less advanced than comparable efforts by Russia or China. In English-language contexts, these operations typically portray the West as ‘degenerate’, with a particular emphasis on antisemitic attacks targeting of Jews and Israel, or heavy promotion of the Iranian state. These fairly unsophisticated influence campaigns are often disrupted by security services early in their lifecycle, undercutting their potential for genuine impact.
The UK far left has a well-documented relationship with Iran, including via academics like Professor David Miller, who was dismissed from Bristol University over allegations of antisemitism but subsequently found by a tribunal to have been unfairly dismissed. Miller regularly appears on a show called ‘Palestine Declassified’ on Iranian state television channel Press TV, the host of which is a former Labour MP who was suspended for criticising the party’s investigation into antisemitism. Although much of its content is directed at Israel, the show has also been used to spread conspiracy theories about Jewish individuals and groups, and to attack UK media and counter-terrorism policy. The short-lived election of former Press TV presenter George Galloway in Rochdale demonstrates the ability of such figures to attain parliamentary influence and legitimacy. Galloway recently travelled to Tehran to receive the Ismail Haniyeh award (named for Hamas’ deceased political leader) from a state media outlet.
Ofcom has taken actions against overt influence operations from Iran in the past. In 2012, the regulator revoked Press TV’s UK broadcast licence, meaning the channel is only available online. However, there are limitations to Ofcom’s reach: UK-based channel LuaLua, for example, only operates online and is therefore not subject to Ofcom’s broadcasting code. LuaLua has been banned in the US over suspected links to the Iranian regime; it has also hosted interviews in which Hamas’ terrorist attack against Israel on 7 October was described as “a step closer to victory.”
Iran has long been linked to the targeting of dissidents in the UK. In recent years, an ITV News investigation identified an alleged-IRGC linked plot to assassinate two news anchors of the Tehran-critical TV channel Iran International. The channel was recently forced to cease operations in the UK on account of threats to safety. In a separate case, UK-based Iranian dissidents were attacked after protesting a memorial service for former Iranian president Ebrahim Raisi, who died in a helicopter crash.
Responding to hostile state actor activity
Several policy levers have been used by the UK government to attempt to address this increasing hybrid threat. These range from scoping the use of counter-terrorism legislation to proscribe state-linked groups, to the development of new priority offences under the Online Safety Act, compelling platforms to proactively respond to “disinformation from foreign state actors which harms the UK.” The 2023 National Security Act also introduced offences around foreign interference and a Foreign Interference Registration Scheme (FIRS) which requires registration of foreign political influence arrangements. Iran will be subject to this scheme, which comes into force on 1 July this year, meaning that anyone directed by Iran to conduct any activities in the UK must register or face criminal prosecution.
Recognising the growing intersection of state threats and violent extremism, the Independent Reviewer of Terrorism Legislation has had their remit expanded to include review of hostile state threats-related legislation. In an April 2025 speech, the Minister for Security said he had asked the watchdog “to review the parts of our counter-terrorism framework which could be applied to modern day state threats, such as those from Iran.” This includes specific considerations around the application of the proscription mechanism to states and state-linked bodies (such as the IRGC). Such a move would enable special investigative powers, enhanced intelligence sharing, asset freezing and criminalising group membership, as well as having knock on effects for the legality of the group’s online content under the Online Safety Act.
Efforts to curb Iran’s malign influence at the intersection of hostile state activity and support for violent extremism require a whole of government response. Initiatives such as the UK’s Defending Democracy Taskforce have the potential to provide a key mechanism for coordination between agencies, but coordination and intelligence-sharing between the UK and its liberal democratic allies remains key to fully addressing the transnational nature of this threat.
Calls for the establishment of a parallel CONTEST strategy for hostile state threats (building on existing counter terrorism approaches) speaks to the need for parallel capabilities for detection and response around such hybrid threats. This will also require greater investment in prevention, including work to inoculate potentially vulnerable populations against influence operations. Meanwhile, stricter vetting for foreign investment will be required in sectors like telecoms and energy to protect critical infrastructure from cyber and influence threats.
In the context of this growing hybridised threat, an integrated government response which stretches from counter-terrorism to supply chain protection and digital regulation, is increasingly required.
ISD’s 2024 paper ‘Beyond Definitions: The Need for a Comprehensive Human Rights-Based UK Extremism Policy Strategy’ provides a policy roadmap for responding to the interconnected threats from extremism, targeted hate and hostile state actor activity facing the UK and is available here.
