For four decades, operations abroad have been one of the Islamic Republic’s instruments of survival: silencing dissidents in exile, intimidating adversaries and projecting reach far beyond Iran’s borders. Two institutions run them: the Quds Force of the Islamic Revolutionary Guard Corps, and the Ministry of Intelligence and Security (MOIS).

The men at the top keep changing. Quds Force commander Qassem Soleimani was killed in a US strike in January 2020 and succeeded by his deputy, Esmail Qaani. Intelligence minister Esmail Khatib, for decades a central figure in hunting down dissent, was killed in an Israeli strike in March 2026. But the methods have outlived the men. What has changed is who pulls the trigger.

Phase one: state agents, state fingerprints

The regime’s early operations relied on its own personnel and its closest proxies. In 1983, the bombing of the US Marine barracks in Beirut killed 241 American service members; US courts later held Iran liable for supporting the Hezbollah operatives behind it. In 1994, the bombing of the AMIA Jewish center in Buenos Aires killed 85 people; in 2024, an Argentine appeals court ruled that Iran ordered the attack.

The model persisted into recent years. In 2018, a plot to bomb the National Council of Resistance of Iran’s annual rally near Paris was foiled. A Belgian court convicted Assadollah Assadi, a serving Iranian diplomat, of organizing it and sentenced him to 20 years in prison. Tehran secured his release in a 2023 prisoner exchange.

The weakness of this approach is obvious: when state agents are caught, the trail leads straight back to Tehran. Assadi’s conviction put a working diplomat in the dock and the regime’s embassies under scrutiny across Europe.

Phase two: middlemen

The regime began inserting intermediaries between itself and the act. In 2011, Manssor Arbabsiar, an Iranian-American recruited by the Quds Force, tried to hire what he believed was a Mexican drug cartel to bomb a Washington restaurant and kill the Saudi ambassador. His “cartel” contact was a US government informant. In 2018, two men working for Iranian intelligence were arrested in the United States for surveilling members of Iran’s organized opposition, and both later pleaded guilty.

In November 2024, the Justice Department charged Farhad Shakeri, whom it described as an IRGC asset living in Tehran. Prosecutors said he had used a network of criminal associates he met in a US prison to supply operatives for IRGC surveillance and assassination plots, including one against journalist Masih Alinejad, and that the IRGC tasked him in October 2024 with planning the assassination of Donald Trump. The intent was hardly hidden: in 2022, the Supreme Leader’s official website published an animated video depicting a drone strike on Trump on a golf course.

Phase three: gangs for hire

In Europe, the shift is now unmistakable. Researchers tracking Iranian external operations have counted 102 plots in Europe since 1979, more than half of them (54) between 2021 and 2024, many involving criminal recruits.

The clearest example is Sweden’s Foxtrot network. In March 2025, the US Treasury sanctioned the gang and its leader, Rawa Majid, saying he had cooperated with Iran’s intelligence ministry and that the network had orchestrated an attack on the Israeli embassy in Stockholm. Iran-based trafficker Naji Sharif Zindashti, whom US authorities say Iranian security forces protect, runs another criminal network the regime has used for operations abroad.

Why outsource, and why it keeps failing

The logic is simple. Criminals are cheap, disposable and already embedded in the target country. They have no paper trail to an Iranian embassy. When they are arrested, Tehran denies everything.

But the method has a structural flaw: criminals talk. Arbabsiar’s cartel was an informant. Shakeri described the plots to the FBI himself. Gang members facing long sentences have every reason to cooperate with prosecutors, and each case maps more of the network back to its handlers. Deniability has become thinner with every trial.

Failure does not mean the threat is small. Each foiled plot is a near miss, and the targets, from dissidents and journalists to diplomats and Jewish communities, live with that risk every day.

What comes next

A regime fighting for survival at home has historically turned outward, and exiled dissidents are its most accessible targets. With its leadership decimated by war and its legitimacy at a low, Tehran has more reason, not less, to show it can still reach its critics abroad.

Western governments now have stronger tools. The EU designated the IRGC a terrorist organization in January 2026, and Treasury sanctions now reach the criminal networks themselves. The task is to use them: prosecute the networks, expose their handlers, close the embassies that serve as logistics hubs, and treat transnational repression as the national security threat it is.