The IRGC is believed to be increasingly using criminal gangs in London, drawing on methods similar to those used by organized crime networks worldwide
In recent months, the Islamic Republic appears to have shifted its methods for deploying proxy actors to carry out intimidation, espionage, sabotage, violent attacks, and, in some cases, alleged terrorist activities against its opponents as well as Jewish targets in Britain.
According to information reviewed and verified by The Media Line, the Islamic Revolutionary Guard Corps (IRGC) is making greater use of criminal gangs, including networks that recruit teenagers, drawing on methods resembling those seen in Scandinavian organized crime cases and on operational patterns often associated with Russian intelligence services.
2 injured during stabbing in Golders Green, April 29, 2026. Following a series of terrorist attacks targeting Jewish communities, London’s Metropolitan Police raised the national terrorism threat level to Level 4. (Screenshot: YouTube)
Following a series of attacks targeting Jewish communities, the UK national terrorism threat level was raised to “severe,” meaning an attack is considered highly likely in the next six months. British authorities said the upgrade followed the Golders Green attack and a broader rise in concern over terrorism threats.
At the same time, new groups have emerged to recruit and manage such criminal gangs. One such organization is Harakat Ashab al-Yamin al-Islamia (HAYI), whose name surfaced after an attack on the Persian-language broadcaster Iran International in northwest London, where Molotov cocktails were allegedly thrown into the outlet’s parking area. The group later circulated a video on Telegram purporting to show the attack.
The incident caused no major damage, but it highlighted the vulnerability of a broadcaster that has long faced threats and intimidation linked to the Iranian regime. Police said three suspects were arrested after a vehicle pursuit ended in a crash; those charged included two British men, aged 21 and 19, and a 16-year-old boy.
Iran International has repeatedly faced security threats. In 2024, one of its journalists was stabbed outside his home in London, an attack that renewed scrutiny of the safety of Persian-language journalists living in exile. In many other cases, both current and former staff members of the broadcaster have reported serious threats and intimidation.
HAYI also claimed responsibility for attacks against ambulances belonging to a Jewish organization in north London, where Jewish and Iranian communities have lived side by side for years and have often supported one another. The group also claimed responsibility for the attack carried out by Essa Suleiman against two Jewish men in Golders Green. During that incident, a bystander intervened, helping prevent more serious harm and stopping the attacker from escaping.
The IRGC, and especially its external operations apparatus, often referred to as Unit 840, is widely believed to play a central role in the Islamic Republic’s overseas operations. In recent years, and particularly after the recent war with Israel, these networks appear to have expanded their activities through a combination of Iranian and non-Iranian regime supporters in London and across Britain, alongside financial channels operating through exchange houses and other financial institutions allegedly involved in financial transfers and money laundering.
With the assistance of criminal organizations such as the Zindashti Network, these structures have reportedly been able to establish links with organized crime groups.
A security analyst in Tehran told The Media Line that in many European cities, the Islamic Republic’s covert networks are engaged not only in surveillance and intelligence gathering, but also in building proxy groups to threaten dissidents, target selected individuals, and demonstrate capability to European security authorities. That assessment reflects mounting concern among British officials, journalists, and rights groups over Iran-linked threats in the UK.
Several Iranian journalists in London, including this writer, say they have repeatedly been followed by individuals believed to be linked to the IRGC, some of whom have presented themselves as diplomatic staff attached to the Iranian embassy. The Islamic Republic has also long been accused by dissidents and analysts of using Iraqi and Afghan Shiite networks to help identify or recruit operational assets abroad.
A person raises a fist next to a sign reading No To Execution during a demonstration organized by members of the Iranian opposition to demand justice, human rights, and freedom for the Iranian people, in Paris, France, February 8, 2025. It is believed that the Islamic Republic’s diplomatic missions have been used as hubs for espionage and for planning attacks against dissidents. Diplomats affiliated with the regime have repeatedly been expelled from European countries or faced legal proceedings over such activities. For this reason, many Iranians have called for the closure of the Islamic Republic’s embassies and diplomatic missions. (BASTIEN OHIER/Hans Lucas/AFP via Getty Images)
The human rights organization Hana says the Islamic Republic uses its diplomatic missions for espionage and hostile activity against opposition journalists and dissident groups.
Shilan Vakili, the organization’s spokesperson, told The Media Line: “There are reports that some individuals who were forced to visit Iranian consulates were questioned about their political activities, their relationships with various people, and even aspects of their personal lives.”
Vakili said such encounters amounted to intelligence extraction. She added that the Islamic Republic uses its embassies and consulates, under diplomatic cover, to conduct espionage, build cases against opponents, and infiltrate Iranian communities through people posing as refugees, journalists, or researchers.
British security services have in recent months arrested several Iranian nationals and other suspects—some of whom allegedly entered the country illegally, claiming to be asylum seekers—in operations linked to national security concerns. Officials have said some of those detained were involved in surveillance on Iranian dissidents and Jewish centers in London.
Until only a few weeks ago, virtually nothing was known publicly about HAYI. Some analysts, therefore, believe the group may be an artificial construct composed of gang members and hired teenagers used for specific operations, echoing methods previously attributed to Iranian-linked activity in Sweden and Denmark involving criminal gangs targeting Israeli or Jewish interests.
Investigative journalist Jane Prinsley of the Jewish Chronicle told The Media Line that “the name of this group has only emerged in recent weeks, after the recent war with Iran, and that is very frightening because these attacks are unpredictable.” She added that more evidence and intelligence would be needed before concluding that the group receives direct orders from the IRGC.
Prime Minister Keir Starmer warned after the Golders Green attack that Iranian attempts to stir up violence in Britain would not be tolerated, accusing Tehran of spreading hatred and violence and attempting to destabilize the country.
Part of the Islamic regime’s terrorist operations abroad is allegedly carried out through the Zindashti criminal network, whose leader has been described by some media outlets as “Iran’s El Chapo.” (Social media)
At the center of many of these allegations stands the Zindashti Network.
The network has previously been accused of threatening journalists and dissidents investigating its activities. It is associated with Naji Sharifi Zindashti, a figure who has long been described in media and sanctions reporting as a major international organized crime boss with links to Iranian intelligence.
In May 2026, Britain sanctioned members of the network’s broader financial architecture operating in London and abroad. According to the UK government, the sanctions targeted the Zindashti Network as well as exchange houses and individuals accused of providing financial and operational support for hostile Iranian activity. Some of those sanctioned were British citizens or residents, while others reportedly held St. Kitts and Nevis passports and were active in the exchange-house business.
In recent years, alongside cooperation with European criminal organizations involved in human trafficking and drug smuggling, the network has also been linked to the kidnapping and assassination of Iranian dissidents in Turkey and Europe, as well as assassination plots against two individuals in the United States.
According to multiple reports, the network operates not only in London but across Eastern Europe, Turkey, and Azerbaijan through extensive smuggling routes. It has allegedly played a role in recruiting hitmen and operatives tasked with surveillance or assassination missions against Iranian dissidents.
Some of those hired to monitor Persian-language journalists and television stations in London, or to threaten them, may also have been recruited through this kind of criminal infrastructure. That possible overlap between organized crime and state-backed coercion is one of the most disturbing features of the Islamic Republic’s alleged overseas playbook.
Zindashti himself was once known as a drug trafficker in Iran before fleeing to Turkey, where he became associated with IRGC intelligence units. He was later arrested in Turkey on drug-trafficking charges, released under controversial circumstances, and fled back to Iran. Today, he appears publicly alongside senior regime officials, including President Masoud Pezeshkian, portraying himself as a philanthropist.
Alongside these criminal organizations, the Islamic Republic has also developed a network in London of Shiite activists from various countries through public institutions such as the Islamic Centre of England, as well as through private gatherings coordinated by the Iranian embassy, mosques, and affiliated Islamic centers.
Pro-Iranian government supporters hold the images of Mojtaba Khamenei (left) and his late father, Ali Khamenei, on Al-Quds Day, on 15th March, in London, England, 2026. Many Iranians in London believe the city has become a safe haven and operational backyard for the Islamic Republic, where the regime has accumulated significant financial, logistical, and human resources.(Richard Baker /In Pictures via Getty Images)
In times of crisis, these networks could potentially function as a “fifth column.”
Together with Kurdish, Turkish, Albanian, Romanian, and low-level criminal gangs, these networks are believed to receive instructions directly from IRGC operational officers operating in London under diplomatic cover.
MI5 has officially identified the Islamic Republic, alongside Russia, as one of the most serious threats to Britain’s domestic security. But it is possible the Islamic Republic’s network of operatives in Britain is far broader and more layered than what has publicly emerged so far.
For decades, London has been both a base for the regime’s operatives and privileged elites, as well as a major financial hub for supporters of the Islamic Republic. A regime that has assassinated thousands of opponents over the years now appears increasingly willing, particularly after the January uprising and the heavy blows it suffered during the recent war, to openly threaten dissidents abroad and extend its climate of fear and intimidation beyond Iran’s borders.
