SecAlliance's Disinformation Monitoring and Managed Cyber Threat Intelligence services provide continuous visibility into narrative-based threats, including the detection of coordinated campaigns, early identification of emerging content targeting clients, and structured intelligence to support communications and crisis response teams. Learn how we can support your organisation.
Contact usNatasia Kalajdziovski, Senior Fusion Threat Intelligence Analyst at SecAlliance, examines how Russia and Iran are outsourcing sabotage and intimidation in Europe to deniable proxies, what this activity reveals about the evolution of state-backed hybrid and proxy operations on the continent, and what risks this poses for European governments, institutions, and organisations.
A fire at a Jewish site. A railway line disrupted. A dissident placed under surveillance. A teenager recruited online to attack a target whose meaning he barely understands. Individually, such incidents can look amateurish, criminal, or random. Taken together, they point to one of Europe’s most serious emerging security problems: hostile states outsourcing violence to proxies.
This is not the old model of terrorism, in which a named organisation claims responsibility for a spectacular attack and seeks ideological glory. Nor is it classic espionage, where professional officers operate under diplomatic cover. The new model is murkier. It blends criminal labour, online recruitment, state direction, extremist propaganda, and plausible deniability. Its power lies not only in the damage it causes, but in the uncertainty it creates.
Russia and Iran are not identical actors. Moscow’s campaign in Europe has been tied by Western officials to sabotage, arson, surveillance, and assassination plots designed to intimidate opponents and raise the cost of supporting Ukraine. Tehran’s recent wave, especially since the Iran conflict that began on 28 February 2026, appears more focused on Jewish, Israeli, Iranian dissident, and Western-linked targets. Yet both have converged on a similar method: use disposable people for deniable acts, generate fear, and force European democracies to defend thousands of soft targets at once.
That convergence should worry Europe. Proxy violence allows hostile states to operate below the threshold of war while still producing strategic effects. A warehouse fire may not look like an act of war. A synagogue vandalism case may first appear to be local extremism. A surveillance operation against a dissident may be treated as ordinary harassment. But when such acts are directed, encouraged, financed, or exploited by foreign states, they become part of a wider campaign.
The danger is not only that Europe will underestimate the threat. It is that Europe will misclassify it.
The word “proxy” often brings to mind formal armed groups: Hezbollah in Lebanon, the Houthis in Yemen, Wagner in Africa, or militia networks operating in the Middle East. But in the European context, the proxy model is often less formal and more opportunistic. A proxy may be a criminal gang, an extremist front group, a migrant-smuggling contact, a local activist, a petty offender, a teenager recruited through social media, or a seemingly freelance operative who never fully understands the strategic purpose of the task.
What matters is not whether the person carrying out the act is ideologically committed. Often, they are not. What matters is the relationship between delegated action and deniability. A hostile state, or an organisation linked to it, identifies a target, provides instructions or incentives, and distances itself from the final act. The person who commits the offence can then be dismissed as a lone criminal, a disturbed extremist, or a local actor with no obvious connection to a foreign capital.
This ambiguity is not a weakness in the model. It is the model. It slows political response, complicates prosecution, and creates a fog in which hostile states can threaten European societies while avoiding clear thresholds for retaliation. By the time a chain of command is established, the psychological effect has already occurred.
That makes proxy action especially attractive to states that want to impose costs on Europe without triggering a direct military confrontation. A bomb plot, arson attack, surveillance operation, or vandalism campaign can be cheap, deniable, and disruptive. It may be tactically small but strategically useful.
Russia’s sabotage model
Fig 1 – Map of selected suspected Russian sabotage and proxy operations in Europe.
Russia’s proxy activity in Europe must be understood in the context of the war in Ukraine. Since the full-scale invasion in February 2022, European governments have sent weapons, ammunition, intelligence support, sanctions enforcement, training, and political backing to Kyiv. Moscow has responded not only on the battlefield, but also through pressure against the European rear area.
Western officials and analysts have described a growing Russian campaign of sabotage, arson, espionage, assassination plotting, and disruption across Europe. The Center for Strategic and International Studies (CSIS) assessed in 2025 that Russia was conducting a “shadow war” against the West, involving sabotage and subversion, and noted that incidents escalated sharply from 2023 to 2024. Associated Press reporting in May 2026 cited Western officials linking more than 150 sabotage-related incidents to Moscow since the start of the Ukraine war, while Polish security officials warned that Russia was moving from low-cost recruits toward more professional sabotage cells.
The logic is straightforward. Russia cannot easily defeat NATO militarily without risking a wider world war. But it can raise the cost of European support for Ukraine. It can make infrastructure feel vulnerable, force security services to chase multiple small threats at once, intimidate Russian dissidents and Ukrainian activists, and encourage Europeans to wonder whether support for Kyiv is bringing danger home.
In this Russian model, sabotage does not need to be spectacular to be effective. A fire at a warehouse, an attempted attack on a logistics hub, a cyber intrusion, a railway disruption, or an assassination plot can all serve the same broader aim: to create insecurity and signal reach. RUSI has noted that arson remains one of the most frequently observed sabotage methods in publicly documented Russian-linked cases, including incidents in Poland involving warehouses, restaurants, and commercial sites.
Fig 2 – Photo showing damage to a warehouse in east London which was storing goods for Ukraine, after a fire which prosecutors said was organised on behalf of Russia's intelligence services. (London Metropolitan Police via AP)
Russia has also made use of proxies because its traditional intelligence presence in Europe has been degraded. After the 2018 Skripal poisoning in the UK and especially after the 2022 invasion of Ukraine, many European states expelled Russian intelligence officers operating under diplomatic cover. That did not end Russian activity. It changed the labour model. Instead of relying only on trained officers, Moscow and its services have increasingly been accused of using criminals, online recruits, and disposable intermediaries. AP reporting in 2026 described Russian efforts to kill opponents in Europe as relying in part on criminal proxies, with plots or incidents reported across countries including France, Lithuania, Germany, Poland, and Spain.
This is the “gig economy” of sabotage. Tasks can be broken into pieces: photograph a site, deliver a package, set a fire, rent a vehicle, follow a target, transfer money, create a false account. Each person may know only a fragment. That fragmentation protects the sponsor and makes investigation harder.
Fig 3 – Analysis on Russian weapons used in sabotage attacks in Europe by CSIS [source].
Iran’s proxy activity in Europe has a different strategic background. Tehran has long been accused by Western governments of targeting dissidents, journalists, Jewish communities, Israeli-linked institutions, and opponents of the regime abroad. What appears to have changed since the Iran conflict began on 28 February 2026 is the tempo and visibility of suspected Iranian-linked activity.
The recent wave has included alleged or suspected attacks, threats, arson attempts, vandalism, and claimed operations against Jewish and Israeli targets, as well as intimidation of Iranian dissidents and media figures. The Guardian reported in April 2026 that security and intelligence analysts believed Iran was orchestrating a campaign of low-level hybrid warfare in the UK and Europe, often involving teenagers and petty criminals recruited through intermediaries or social media.
One name that has appeared repeatedly in analysis of this wave is Harakat Ashab al-Yamin al-Islamia, or HAYI. Jamestown described HAYI as a newly emerged group strongly suspected of being an Iranian proxy operating under IRGC influence and reported that it had claimed more than 15 non-lethal attacks across Europe against Jewish and Israeli targets since March 2026. The Institute for Strategic Dialogue has similarly characterised the group as a “gig-economy” proxy, noting that it appears to use online mobilisation and low-level actors while projecting a more organised ideological image.
Fig 4 - A Telegram channel claiming to represent HAYI said it was responsible for an arson attack on four Jewish ambulances in north London [source].
Here, too, caution is important. Some incidents remain under investigation. A group claiming responsibility for an attack does not automatically prove operational control by Tehran. But the broader pattern is significant: target selection, messaging, timing, and method can all matter. When Jewish institutions, Israeli-linked sites, Iranian dissidents, and critical journalists are repeatedly targeted amid an international conflict involving Iran, analysts and investigators are right to ask whether local incidents are part of a wider hostile-state campaign.
Iran’s likely aim differs from Russia’s. Moscow’s proxy operations are heavily tied to coercing Europe over Ukraine and weakening the credibility of European security. Tehran’s suspected activity is more focused on retaliation, deterrence, and intimidation. It sends a message to Jewish communities, Israeli institutions, dissidents, and Western governments: Iran’s conflicts will not remain geographically confined to the Middle East.
The damage from many of these incidents may be limited. But that should not lead us to minimise them. Terrorism is not measured only by casualty count. A low-level attack on a synagogue, school, memorial, or community centre can generate fear far beyond the immediate physical damage. It can force parents to reconsider sending children to school, raise security costs for religious institutions, and make minority communities feel permanently exposed.
Russia and Iran differ in ideology, strategic geography, and target selection. Russia presents itself as a revisionist great power fighting NATO expansion and Western dominance. Iran presents itself as a revolutionary state resisting Israel, the United States, and their allies. Their European proxy operations are not identical.
Yet the overlap is increasingly visible.
This is why the term “hybrid warfare” is useful, but only if used carefully. It should not become a lazy label for everything short of war. In this context, it describes a real blending of statecraft, espionage, terrorism, organised crime, cyber activity, propaganda, and coercive signalling.
The battlefield is not only physical infrastructure. It is public confidence.
European states have strong counter-terrorism systems, capable intelligence services, and increasingly sophisticated cyber and counter-espionage tools. Yet proxy violence creates several specific problems.
The first is classification. Was an arson attack a hate crime, a terrorist act, organised crime, espionage, or foreign sabotage? Different labels activate different investigative powers, prosecutorial strategies, public communications, and political responses. Hostile states benefit when authorities are slow to connect cases across categories.
The second is attribution. Democracies usually require evidence before publicly blaming a foreign state. That is appropriate. But hostile states exploit the time lag between suspicion and proof. Public confidence can erode in the gap.
The third is scale. A small number of hostile actors can generate a huge defensive burden. Europe cannot put a police officer outside every synagogue, warehouse, railway junction, dissident office, and defence supplier. The attacker chooses the time and place; the defender must protect everything.
The fourth is diaspora sensitivity. Russia and Iran both target diaspora communities, but they may also seek to recruit or manipulate individuals within them. A clumsy response can stigmatise entire communities, which is both morally wrong and strategically self-defeating. Iranian dissidents, Russian exiles, Jewish communities, Ukrainians, and other groups are often the victims of these campaigns, not their source.
The fifth is the legal grey zone. Existing laws were often built around clearer categories: terrorist organisation, foreign intelligence service, hate crime offender, organised criminal group. Proxy networks blur those categories. A person recruited online to set fire to a building may not know they are serving a foreign state. That does not make the act harmless, but it complicates prosecution and deterrence.
Fig 5 – MI5 head Ken McCallum warning of increasing Russian sabotage operations during his 2024 annual update [source].
The UK appears to be moving in this direction. Forthcoming legislation could allow individuals carrying out antisemitic attacks on behalf of hostile foreign powers, such as Iran, to face up to 14 years in prison, including in cases where the perpetrator did not know they were acting for a foreign government. That reflects a broader recognition that European law needs tools for state-sponsored proxy activity that falls between espionage and terrorism.
The first step is conceptual. European governments need to treat proxy violence as a joined-up national-security threat, not as a series of isolated local incidents. That does not mean exaggerating attribution or blaming foreign states without evidence. It means building systems that can identify patterns across hate crime, organised crime, counter-terrorism, counter-espionage, and cyber investigations.
Second, intelligence sharing needs to become faster and more operational. A suspicious arson attempt in one country, a Telegram recruitment channel in another, and a payment route through a third may only make sense when viewed together. Europol, domestic intelligence agencies, financial intelligence units, and local police need mechanisms for connecting those fragments quickly.
Third, Europe should focus on the money. Proxy operations may be cheap, but they are not free. Payments to recruits, travel costs, equipment purchases, cryptocurrency transfers, and criminal intermediaries create traces. RUSI has argued that sabotage financing is an overlooked part of the Russian sabotage ecosystem and can be both an enabler and a vulnerability. The same principle applies more broadly: follow the money, and you may find the network.
Fourth, online recruitment deserves more attention. The use of social media and encrypted platforms to recruit low-level actors is now central to the problem. That does not require mass surveillance of ordinary users. It requires targeted monitoring of recruitment patterns, better cooperation with platforms, and faster disruption of accounts used to solicit criminal or terrorist acts.
Fifth, Europe must harden soft targets intelligently. Jewish schools, synagogues, Israeli-linked institutions, Iranian dissident media, Ukrainian logistics hubs, defence companies, and transport infrastructure all need practical support. But physical security alone is not enough. Communities need clear communication from authorities, trusted liaison officers, and reassurance that incidents are being treated with appropriate seriousness.
Sixth, governments should be willing to impose costs on sponsors, not just perpetrators. Arresting the teenager who lit the fire is necessary. It is not sufficient. If a foreign intelligence service, IRGC-linked network, or Russian proxy structure directed the act, the response should include sanctions, expulsions, prosecutions, asset freezes, public attribution where evidence permits, and coordinated European action.
Finally, European leaders must avoid panic. Proxy warfare thrives on fear and overreaction. The objective is often to make democratic societies turn on themselves: to stigmatise minorities, exaggerate insecurity, polarise politics, or lose faith in institutions. A successful response must be firm without becoming indiscriminate.
The most important thing to understand about proxy violence is that the visible target is not always the real target. A synagogue may be attacked, but the intended audience may be an entire Jewish community. A warehouse may be burned, but the message may be aimed at governments supplying Ukraine. A dissident may be watched, but the warning may be intended for every exile who thinks Europe offers safety.
Russia and Iran have different strategic aims, but both understand this theatre of fear. They know that European societies are open, pluralistic, legally constrained, and politically sensitive. They know that a small act can produce a large argument. They know that ambiguity can be as useful as proof.
Europe should not respond by collapsing every distinction. Russian sabotage, Iranian-directed intimidation, antisemitic terrorism, organised crime, and local extremism are not all the same thing. But Europe should recognise when they intersect. The proxy is the point of intersection: the person or group through whom a hostile state converts intent into action while hiding its hand.
That is the challenge now facing Europe. Not invasion in the conventional sense, but intrusion. Not always mass-casualty terrorism, but persistent intimidation. Not always professional spies, but disposable recruits. Not a single campaign, but a pattern of hostile-state behaviour that exploits the seams between crime, terrorism, and war.
The old security question was: who carried out the attack?
The new question is harder: who wanted it done, who paid for it, who selected the target, who benefits from the fear, and what wider campaign does it serve?
Until Europe gets better at answering that question, Russia and Iran will continue to find value in the proxy model. They will keep outsourcing risk to the expendable, hiding strategy behind criminality, and turning Europe’s openness into a field of pressure.
The task is not only to stop the next fire, plot, or act of intimidation. It is to make deniable violence less deniable, disposable proxies less useful, and European societies less easily frightened.
References
{{standout}}
