Iran and Russia blamed for growing list of hybrid attacks in Europe

A hybrid attack combines different forms of pressure. These can include sabotage, arson, intimidation, cyberattacks, espionage, and criminal violence. Unlike a conventional military attack, it may not involve uniformed troops crossing a border or openly striking military targets. Its mixed nature can make responsibility harder to prove.

The article gives several examples. HAYI claimed attacks on synagogues, ambulances, a Jewish school, and other sites. An attempted arson attack also targeted Iran International, while a suspected plot involved RAF Fairford, a base used by U.S. bombers. These actions used explosives, fire, weapons, or alleged criminal proxies.

This approach matters because it spreads fear without looking like a formal war. It can pressure communities, disrupt institutions, and test security responses. The article says Russia and Iran are expanding such tactics across Britain and Europe, with Iran moving toward harder targets.

Iran- and Russia-linked operations described here reach well beyond military facilities. They target public spaces, religious communities, businesses, media organizations, and individuals. The goal can be intimidation, disruption, or damage rather than battlefield victory. This broad target set is central to hybrid activity.

Examples include synagogues in Belgium, the Netherlands, and Britain. Other targets included Jewish ambulances in Golders Green, a Jewish school in Amsterdam, Iran International in London, and Christians For Israel in Nijkerk. The article also describes alleged plots involving the Bank of America headquarters, RAF Fairford, and a Jewish community in Manchester.

The article specifically identifies Iranian or suspected Iranian links for these incidents. It also says Russia and Iran have targeted everything from air force bases to synagogues across Britain and Europe. The supplied text does not provide detailed Russian incident examples.

The reported problem is substantial but unevenly quantified. MI5 chief Sir Ken McCallum said Iranian hybrid activity led to more than 50 arrests in the U.K. over the last year. The article then lists incidents across Britain, Belgium, the Netherlands, and France, showing a campaign that crossed borders and used varied methods.

The list includes explosive devices at a synagogue and Jewish school, firebombings, attempted arson, attacks on ambulances, a car fire, suspected sabotage, and stabbings. It also includes alleged plots involving RAF Fairford and a Jewish community in Manchester. The dates run from March 9 through October 2, with an additional reference to a 2024 stabbing.

The scale therefore includes both completed attacks and disrupted or alleged operations. Some incidents were claimed by HAYI, while others remained unclaimed or unconfirmed. The article gives no comparable arrest total or incident list for Russia.

The main alleged state actors are Russia and Iran. MI5 chief Sir Ken McCallum calls Russia the leading threat, while describing a major shift in Iran’s ambitions. The article says Iran has used criminal proxies against opposition figures, Iranian media organizations, and Israeli sites, then expanded toward harder targets.

The named proxy group is HAYI, or the Islamic Movement of the Companions of the Right. Britain sanctioned it and said it was directly tied to Iran’s Quds Force, part of the Islamic Revolutionary Guard Corps. HAYI claimed many attacks. British counterterrorism police and security services also believed Iranian authorities used criminal proxies against journalist Pouria Zeraati.

Authorities in Britain, Belgium, the Netherlands, and France investigated incidents or suspected links. The article does not identify individual criminals or give operational details about Russian proxies. Some allegations remained unconfirmed, and one attempted arson attack was never claimed.

The article does not directly explain why Russia and Iran choose these methods. In general, covert or indirect operations can offer deniability, reduce immediate military risk, and exploit weaknesses inside another country. They can also impose costs on societies without triggering the clear response associated with an openly declared attack.

Iran’s alleged use of criminal proxies illustrates the mechanism. HAYI claimed attacks on Jewish communities and other sites, while Britain said the group was tied to Iran’s Quds Force. Criminal actors can carry out arson, sabotage, intimidation, or violence while making the chain of command harder to establish.

This ambiguity complicates decisions by governments and alliances. Investigators must distinguish genuine state direction from independent criminal action, and public authorities must protect civilian targets without escalating prematurely. McCallum says both countries are using increasingly varied hybrid tactics, suggesting that such pressure may continue and spread.

NATO Article 5 treats an armed attack against one member as an attack against all. If a hybrid operation met that threshold, the targeted country could request consultations and allies would consider assistance. That response could include military force, but Article 5 does not automatically require every ally to declare war or use troops.

The key issue is classification. NATO has no fixed public number of casualties, damage level, or attack type that automatically activates Article 5. Allies judge the facts and circumstances together. A serious, state-directed attack causing major harm would be more likely to qualify than an isolated criminal incident, though the decision remains political and collective.

The article does not say that any listed incident reached the Article 5 threshold. Most involved alleged proxies, arson, explosives, intimidation, or plots. The uncertainty over responsibility and scale is precisely why hybrid attacks can create danger without producing an immediate alliance-wide military response.

The gray zone is the space between ordinary peace and declared war. States use it to compete without launching a conventional invasion or openly fighting another government. The article describes this environment through attacks on communities, businesses, media organizations, military sites, and religious institutions. These actions blur the line between state conflict and crime.

The mechanism is layered pressure. A state may rely on criminal proxies, deniable operatives, sabotage, arson, cyberattacks, or intimidation. Iran’s alleged connection to HAYI shows how a proxy can claim attacks while authorities investigate the state behind it. Russia and Iran are both described as expanding hybrid tactics, although the supplied text gives few Russian examples.

This competition can test defenses, frighten communities, and strain political decision-making. It also forces governments to prove attribution before responding. As targets move from government property toward people, businesses, and communities, national security agencies must defend society as a whole, not only military installations.