Since the United States and Israel launched their war against Iran on Feb. 28, a string of terrorist attacks has rocked several European cities — Paris among them, had the Antiterrorism Prosecutor’s Office not intervened on time.
While no attack can with certainty be attributed to Tehran, experts are increasingly persuaded Iran is the culprit. Even Europol, the EU’s law enforcement agency, has warned of soaring terrorist risk across the continent, as Tehran may seek to retaliate against Jewish communities and American interests.
The first attack took place 100 kilometres away from Brussels, in the city of Liège, as an improvised bomb detonated on March 9. It was promptly condemned by Belgium's Prime Minister Bart De Wever as “antisemitic” and an “attack on our values and our society.” Soon after, similar targeting of Jewish communities happened in Rotterdam, Amsterdam, London and Antwerp.
They have been claimed by the group Harakat Ashab al-Yamin al-Islamia — “The Islamic Movement of the Companions of the Righteous," which was formed after the U.S.-Israeli strikes began last month.
For now, however, it’s unlikely the attacks will alter the EU’s reluctance to enter the conflict.
European leaders have been adamant that this is not their war. Spain, which has condemned the strikes as squarely at odds with international law, has refused access to its jointly operated military bases and has banned the use of its military airspace. Italy, a much closer ally to the Trump administration, has likewise denied U.S. use of its Sigonella naval air station in Sicily.
Still, should attacks on European soil escalate, and Iran’s hand become harder to discount, European countries could find themselves in an increasingly untenable position, said Thomas Renard, Director of the International Centre for Counter-Terrorism.
In an interview with The Parliament, he unpacked the group’s potential links to Iran, the likelihood of EU countries getting drawn into the Middle East war and how member states can defuse the risks of future terrorist attacks.
This interview has been edited for length and clarity.
Can we determine whether these recent attacks are directly linked to the war in Iran?
At this stage, the short answer is no. The group that has claimed these attacks did not exist before March 11. As a matter of fact, it’s a new group, and their claims do not refer directly to the war in Iran. The claims refer to Israel, to Zionism, to Americans and to Palestine, but they do not refer yet directly to Iran.
However, if you scratch below the surface, several elements suggest a possible link. The attacks began only a few days after the start of the war, and the group itself appears to have been created specifically for this campaign. The first attack in Liège was claimed through a pro-Iranian Telegram ecosystem, and subsequent attacks were also claimed in the same environment. That is an important indication.
Also, if you look at the image of the group, it does refer quite strongly to the iconography of pro-Iran groups like Hezbollah.
So I would say that, together, between the timing of these attacks, the targets, all Jewish sites, synagogues, the iconography of the group and the online ecosystem where these videos were circulated, these are all strong indications that Iran might be behind this wave of attacks.
But again, it cannot at this stage be said with full confidence, because the smoking gun is not there. And that is actually precisely the reason why they [Iran] are acting like this. By maintaining plausible deniability, Iran makes it difficult to attribute responsibility directly, which in turn reduces the risk of drawing European countries into the conflict. Plausible deniability is nothing new. That’s the very nature of hybrid warfare.
Attacks have taken place in Belgium, the Netherlands and the U.K. Why do you think these specific locations have been targeted?
Clearly, the primary targets are Jewish communities. There are significant Jewish populations in the Netherlands, in Belgium — particularly in Antwerp — and in London, which makes them visible and symbolic targets. That said, Jewish communities exist elsewhere too, so geography alone does not fully explain the pattern. We need to get a better sense based on the arrests and the profile of the people that have been arrested in Rotterdam and in Antwerp.
At this moment, there are two possible hypotheses. The first possibility is that it is relying on criminal networks to carry out attacks, potentially including assassination attempts. These could involve individuals linked to organized crime, including drug trafficking networks, which might help explain why certain countries are being targeted.
The other hypothesis is that Iran is going more the Russian way, meaning recruiting individuals online through Telegram and similar platforms, offering money for small tasks. For example, you get €50 if you do graffiti, €100 if you do something else, and more if you film it. This is well documented in the case of Russia. It is possible that Iran is conducting this campaign in the same way. In that case, the profile of the individuals, their phones, computers and financial transactions will tell us more.
European leaders have made it clear they do not want to get involved in this war. So what is the strategic objective behind these actions?
That is exactly why they are doing it this way rather than openly targeting citizens or political leaders. Iran could do that, but instead they are limiting themselves to the most prominent enemies of Iran, which are Jewish communities and potentially American interests in Europe. Iran has been saying for some time that its enemies are not out of reach wherever they are in the world. Now they are putting this into practice. But again, they are doing it in a way that allows plausible deniability.
So you cannot clearly say this is a campaign orchestrated by Iran, even if all signals point in that direction. This prevents Europeans from being drawn into war. For Iran, it is a win-win. It is very cheap to organize, it has high impact, it sends a signal of intimidation and it forces Europeans to take security measures, which has a cost. For example, deploying soldiers in Antwerp is a direct reaction to the attacks. That weakens resources. Yet the threshold is not high enough to trigger a military response. So Iran benefits without consequences.
What options do European countries have to prevent these types of attacks?
If we consider terrorism, full prevention does not exist. But several measures can be taken. First, strong political signaling that the threat is taken seriously. Second, deterrence — treating these acts as terrorism with heavy penalties. Third, monitoring the online spaces where recruitment happens. Fourth, learning from arrests and investigations. Europeans could also raise the stakes. Even without definitive proof, attribution is often a political decision. Measures could include sanctions, expelling diplomats, or economic pressure, without going to war.
How likely is it that this will escalate? And what might that look like?
Yes, it could escalate in several ways. One is if Iran starts targeting individuals and causing casualties. So far, attacks have only caused material damage. Another is expanding targets beyond Jewish sites to society more broadly. Another escalation would be direct involvement of Iranian agents or proxies like Hezbollah or Hamas. Each step would increase pressure on Europe to respond. Iran controls the pace of escalation.
Are there comparable cases in the past where Iran has used similar tactics? What can those precedents tell us about the current situation?
Yes. For example, the Paris plot involving an Iranian diplomat transporting explosives, the use of criminal networks and a recent case in the U.S. where a man confessed he was recruited by Iran to assassinate political figures. Iran has long used intimidation and targeted violence against its enemies.
Do you think European leaders and institutions fully understand the nature of this threat? Is there sufficient awareness and coordination at the political and intelligence levels?
Security services are aware and have been monitoring Iran and Russia closely. But more could be done, especially in information sharing, monitoring and prevention. Cooperation against jihadist terrorism is strong today, but hybrid operations by states are more complex and political, so cooperation is less advanced.
You mentioned that cooperation is stronger on jihadist terrorism than on state-led hybrid threats. Why is that? Is it due to differing political positions between countries?
Partly, but mainly because the threat is perceived differently. Intelligence sharing depends on necessity. With jihadist terrorism, the threat is clear and immediate. With hybrid operations, it is lower intensity and less visible, so countries are more cautious about sharing sensitive information.
Sign up to The Parliament's weekly newsletter
Every Friday our editorial team goes behind the headlines to offer insight and analysis on the key stories driving the EU agenda. Subscribe for free here.