Adversary Intelligence — 2026-06-26

Soufan Center Analysis: IRGC Expanding Covert Operations Through Disposable Agents and Front Groups Across Europe and North America

BLUFIRGC-directed proxy networks are very likely to execute an attack causing physical harm or significant property damage in Europe or North America within six months, as arrest rates cannot match the disposable-agent recruitment pipeline's replenishment speed.

HAYI, which the Washington Institute for Near East Policy assesses as an IRGC proxy, has claimed 17 incidents across 7 European countries since a March 9 synagogue explosion in Liege, using local youths recruited via Snapchat and Telegram for cash 1. At least 44 arrests have been made across the UK, Netherlands, France, and Belgium, including 11 minors; UK prosecutors have applied criminal damage charges while Dutch and French authorities have filed terrorism counts 1. The Soufan Center additionally reports HAYI-linked plots against US synagogues in Arizona, New York, and Los Angeles, and cites IRGC use of Sweden's "Foxtrot" crime group as a separate criminal-intermediary channel 2. The Hague Initiative for International Cooperation documents a Netherlands pattern in which Iranian intelligence identifies targets, criminal networks provide logistics, and low-level actors execute operations 3.

Analysis
Forty-four arrests have not suppressed a 17-incident tempo spanning four countries, and near-zero-cost digital recruitment replenishes disposable actors faster than interdiction drains them. A HAYI-linked or IRGC-directed attack causing physical harm while evading law enforcement is very likely within six months, as a multi-country footprint forecloses the coordinated simultaneous action that could suppress tempo. Moderate confidence: observed cadence across multiple jurisdictions is consistent, but all attribution rests on Western policy-analysis institutions without declared primary-intelligence access, leaving IRGC command-and-control depth unverified. HAYI may instead be an autonomous criminal enterprise exploiting Iran-adjacent aesthetics, driven by shared ideology rather than directed C2. The Melbourne arson precedent nonetheless demonstrates comparable IRGC proxy reach across Five Eyes. UK designation decisions and US DHS synagogue hardening allocations hinge on whether interdiction failure rates justify escalating to terrorism prosecution frameworks.

3 sources

Deniable, Disposable, Disruptive: Iran's Hybrid Warfare in Europe Demands a Proactive Response - The Washington Institute for Near East Policy
Beyond the Battlefield: Fallout from the Iran Conflict - The Soufan Center
The IRGC in Europe's Grey Zone: Hybrid Influence, Proxy Violence, and the Challenge to Democratic States - thinc. – The Hague Initiative for International Cooperation