German security services are increasingly concerned that Iran may employ not only its own agents but also criminal networks for attacks within the country. They point to incidents where Iranian intelligence recruited organized‑crime members, such as the arson of a synagogue in Bochum.
Parliamentary Control Board chairman Marc Henrichmann (CDU) warned that the more pressure the regime faces, the higher the likelihood of unpredictable responses. He added that Iran‑controlled militias, notably Hezbollah, are currently more active and that Jewish, Israeli and U.S. facilities are receiving special protection.
The Federal Office for the Protection of the Constitution (BfV) clarified that Iranian intelligence consistently targets people connected to the Iranian foreign opposition in Germany. While no violent incidents against Iranian opposition figures have been recorded in Germany, such attacks have occurred in other Western European states.
Former FBI terrorist investigator Matthew Levitt said the timing is “now” for Iran to leverage its capabilities abroad. He argued that as the regime confronts existential threats or potential regime change, it is more likely to retaliate by any means-deploying Iranian agents, terrorist or criminal stand‑ins, or inciting lone wolves. Levitt currently directs the Washington Institute for Near East Policy.
According to the report, retaliation attacks are especially attributed to Hezbollah sympathizers and Hamas supporters. Scandinavian security authorities also focus on the criminal Swedish group Foxtrot, whose leaders reportedly cooperate with Iranian services and have previously planned and executed terrorist attacks on Israeli sites and embassies in Europe at Iran’s behest. Foxtrot, known for violence and drug trafficking, has been sanctioned by the U.S. State Department since March 2025 for its close ties to the Iranian regime.
