European Security — 2026-11-14

Soufan Center Analysis Documents Escalating Gray Zone Hybrid Tactics Targeting Europe Including IRGC Cyberattacks, Bomb Threats, and Terror Plots

BLUFFrance's public IRGC attribution and the parallel SDNY indictment narrow Tehran's deniability on cyber and kinetic tracks, but the unattributed flight and school hoaxes create a low-cost template that copycats can exploit to further strain European security resources.

French Foreign Minister Jean-Noël Barrot said the IRGC carried out the October 11-12 cyberattack on French supermarket refrigeration systems, and Paris prosecutors requested arrest warrants for the leader and two deputies of the IRGC-linked Shahid Kaveh unit 1. The Soufan Center reported about 20 fires and more than 700 stores affected 2, while Al Jazeera cited more than 1,000 stores 1. The Week reported Tehran rejects involvement in the broader cyber campaign 3. Between November 2 and 6, more than 50 European flights received bomb threats, and about 6,300 Italian schools received hoax emails, according to The Week 3; it noted the perpetrators of these incidents are not conclusively identified 3. SDNY announced a superseding indictment on November 10 charging Al-Saadi, Mohajeri and Al-Hassani over nearly 20 attacks and a September plot at RAF Fairford 4.

Analysis
European security services face a campaign mixing attributed state sabotage with unattributed disruption, and the two need distinct responses. France has formally tied the refrigeration attack to the IRGC, while the flight bomb threats and school hoax emails remain unattributed. The SDNY indictment adds a separate track of physical plots, including RAF Fairford, suggesting Tehran runs cyber and kinetic efforts through different networks. Treating all incidents as one operation is not yet supported. The hoaxes may instead come from Russian-aligned or criminal actors using cheap, repeatable methods, with Iran responsible only for the sabotage and plots. Confidence is moderate: a primary court document and French official statements anchor the plots and refrigeration attribution, but the hoax attribution rests on one outlet. Retail, aviation and school authorities should plan for low-cost copycat hoaxes.

4 sources

France accuses Iran of cyberattack on supermarket fridges - Al Jazeera
Europe Besieged by Acts of Gray Zone and Hybrid Tactics from Multiple Vectors - Soufan Center
Hybrid warfare without borders: How Europe's schools, airports and food systems became targets - The Week
Three Iranian-Backed Operatives Indicted For Their Roles In Nearly 20 Terrorist Attacks And Attempted Attacks - U.S. Attorney's Office, Southern District of New York