How Iran Turned Its Embassies Into a Global Terror Network
For over four decades, Iran has weaponized its embassies across four continents to surveil dissidents, facilitate terror, and plot attacks under the cover of diplomatic immunity
As the U.S. and Israel conduct joint strikes against Iran under Operation Epic Fury, targeting missile production facilities, naval assets, and military installations, the operation brings renewed scrutiny to a separate but deeply connected threat architecture: Iran’s global diplomatic network.
Across more than a dozen countries, intelligence agencies have spent years documenting how the Islamic Republic’s embassies serve as the logistical backbone for a foreign terror and espionage apparatus operated by the Ministry of Intelligence (MOIS) and the Intelligence Organization of the Islamic Revolutionary Guard Corps (IO-IRGC).
The evidence, drawn from criminal convictions, parliamentary intelligence reports, mass diplomatic expulsions, and testimony from former Iranian embassy staff, presents a consistent and damning picture.
“Every Embassy Has a List”
In June 2025, Iran International published testimony from multiple former Iranian diplomatic employees whose accounts document what they describe as a foreign service defined not by protocol but by surveillance and covert action.
“Every embassy has a list. People to watch. People to engage. People to silence,” one former employee told the outlet. Another was more direct: “The people sent abroad are on assignment, not appointment.”
According to these individuals, whose identities were protected for safety reasons, Iranian missions maintain the outward structure of any diplomatic posting — ambassadors, attachés, advisers — while the underlying roles frequently serve as cover. “A person listed as a translator might actually coordinate funds for proxy groups,” one former diplomat said. “Titles are just for appearances.”
The Assadi Case: A Blueprint for Embassy-Based Terrorism
No case better illustrates the operational reality described by these former employees than that of Assadollah Assadi. Stationed at the Iranian Embassy in Vienna as a third counselor, Assadi was simultaneously an officer linked to MOIS ‘Department 312,’ which Belgian investigators described as a terror-linked MOIS unit.
On June 30, 2018, Assadi directed an operation to bomb the National Council of Resistance of Iran’s annual gathering in Paris. Prosecutors said that Assadi smuggled roughly 550 grams of TATP explosives uon a commercial flight from Iran to Austria.
Assadi then personally transferred the explosives, a detonator, a USB drive with instructions, and more than €20,000 in cash to a Belgian-based couple, Amir Saadouni and Nasimeh Naami, during a meeting at a Pizza Hut in Luxembourg on June 28, 2018.
Belgian intelligence, acting on a tip from a foreign partner agency, had the couple under surveillance. They were arrested before crossing into France.
Assadi was detained by German police on July 1 near Aschaffenburg. On February 4, 2021, a Belgian court sentenced him to 20 years in prison.
The evidence retrieved from Assadi’s car at the time of his arrest revealed the full scope of the network he had built. Three notebooks contained records of more than 280 meeting locations across eleven European countries, Austria, Belgium, Czech Republic, France, Germany, Hungary, Italy, Luxembourg, the Netherlands, Sweden, and Switzerland, where Assadi had met with what investigators believe were MOIS assets. The notebooks also logged repeated visits to Shiite mosques and Islamic cultural institutes across the continent.
In a peer-reviewed analysis published in 2024, researchers Ardavan and Arvin Khoshnood identified three systemic conclusions from the Assadi case: Iran continues to treat terrorism as a viable tool of statecraft; the MOIS maintains a dense asset network embedded in European civil and religious institutions; and the regime’s counterintelligence is compromised to a degree that forced it to expose its most senior European operative on a personal errand.
On May 26, 2023, Assadi was released from Belgian custody in a prisoner swap for Belgian national Olivier Vandecasteele, who had been held in Iran on charges that included espionage.
A Mounting International Response
The Assadi case was not an anomaly. It was the most visible manifestation of a pattern that intelligence agencies across the Western world have been tracking for decades.
In 1992, Iranian assassins killed four Kurdish-Iranian opposition figures at the Mykonos restaurant in Berlin. One of the convicted perpetrators, Kazem Darabi, was found to have direct ties to Iranian embassy personnel in Germany.
In 1996, former Iranian deputy education minister Dr. Reza Mazlouman was shot dead in his Paris apartment; an accomplice arrested in Germany was found to have maintained contacts with MOIS operatives at the Iranian Embassy in Bonn.
In 2018, the Netherlands expelled two Iranian diplomats for their alleged role in the killings of Iranian opposition figures in Almere and The Hague. According to the Khoshnood study, Since 1979, more than 160 Iranian dissidents in exile have been killed by the Islamic Republic, according to the Khoshnood study.
The pace of documented activity has accelerated significantly. In November 2022, MI5 Director Ken McCullum announced that Iran’s intelligence services had plotted to kidnap or kill individuals on British soil at least ten times between January and November of that year alone.
A July 2025 report by the UK Parliament’s Intelligence and Security Committee, running to 260 pages, concluded that Iran’s threat to the United Kingdom is now on par with Russia’s, documenting assassination plots, kidnapping operations, espionage, offensive cyber activity, and interference operations. MI5 and counter-terrorism police have handled more than 20 threat-to-life cases linked to Iran since the start of 2022.
On July 31, 2025, the United Kingdom, the United States, France, and eleven other allied nations issued a rare joint statement condemning what they described as a surge in Iranian intelligence operations, including assassination plots, stalking, digital hacking, threats to family members, and coordinated smear campaigns targeting dissidents and perceived enemies of the regime living in Europe and North America.
The Canadian Security Intelligence Service warned in its 2023 annual public report that “Iran will continue to target its perceived enemies even when living in foreign countries” and that Iranian threat activity “directed at Canada and its allies are likely to continue.”
According to a report by Bangkok Post in 2022, the Royal Thai Police issued an order placing officers on alert for Iranian operatives believed to be gathering intelligence on Iranian dissidents in the region.
Albania expelled Iranian diplomats in 2018 and 2020, and in 2022 severed diplomatic relations and expelled Iran’s embassy staff after a cyberattack
Front Organizations, Islamic Centers, and the Cultural Attaché Network
Beyond the embassy compound itself, Iran’s operational reach extends through a web of nominally civilian institutions. The Imam Khomeini Relief Foundation has been linked to Hezbollah financing. The Iranian Red Crescent has faced documented allegations of serving as cover for Quds Force weapons transport, allegations its leadership has denied. IRGC members have admitted to posing as aid workers during operations in Bosnia.
State broadcaster IRIB’s international outlets, Press TV, Al-Alam, and Hispan TV, have functioned as propaganda arms and, in documented cases, as intelligence fronts.
The Assadi case explicitly documented the connection between the MOIS and Shiite cultural institutions in Europe, with his notebooks referencing the Islamic Center of Hamburg by name. In July 2024, Germany’s Interior Ministry shut down the Islamic Center Hamburg, citing its ties to Tehran, promotion of extremism, and antisemitism. Iran responded by ordering the closure of German Embassy language schools inside Iran.
In Norway, the national intelligence service PST moved in 2020 to expel the head cleric of the Imam Ali Center in Oslo on national security grounds.
Targeting Jews: From Kenya to Melbourne
The Islamic Republic’s use of diplomatic infrastructure to target Jewish and Israeli populations extends across multiple continents and decades. In October 2025, Mossad revealed that Sardar Ammar, a senior Quds Force officer operating under IRGC Quds Force commander Esmail Ghaani, led a transnational terror network responsible for plots in Australia, Greece, and Germany between 2024 and 2025. Israeli intelligence described the network’s methodology as “terror without Iranian fingerprints,” relying on criminal proxies to provide deniability. Jewish Onliner’s previous reporting covers the Sardar Ammar network in detail.
The Australia case is among the most thoroughly documented. On December 6, 2024, the Adass Israel Synagogue in Melbourne’s Ripponlea neighborhood was firebombed in an early-morning attack. Australia’s Security Intelligence Organisation (ASIO) subsequently traced the funding for that attack, and a separate arson targeting a Sydney kosher restaurant, through a “layer cake” of intermediaries back to the IRGC. On August 26, 2025, Prime Minister Anthony Albanese expelled Ambassador Ahmad Sadeghi and announced plans to designate the IRGC as a terrorist organization, marking Australia’s first expulsion of a foreign ambassador since the Second World War.
A Network Built in Plain Sight
From the Mykonos restaurant in 1992 to the Adass Israel Synagogue in 2024, from Vienna to Baku to Melbourne, the operational thread is consistent. As the Khoshnood study concludes: “The case of Assadi shows that the IRI has the will and resources to conduct significant terrorist operations if deemed necessary.” That will, and those resources, were never confined to Iran’s military. They were woven into its diplomatic corps from the beginning.
👊🏼🖤 Let the Hamans hit the floor 🖤👊🏼
at least NATO showed its irrelevance early on 🤦🏼♂️ when they probably announce that an attack on a British base was not our thing 🤷🏼♂️
Brussels is the NATO headquarters and the scale and the massive buildings and those employed are unfathomable doing nothing but sucking
best Purim ever 🤗
encountering karmic consequences 💥 👊🏼
the decades of enabling and deflecting from these degenerates could fill volumes of political history analysis in civilizational failure if this momentum can continue forward, predictions are futile and instead of shooting up hopium the walls to barbaria have been breached dominated and it's irgc needing retribution and civilian Justice administration if they survive the consequences from the air
gadol nachas moment for those who are choosing to fight back
eurabia seems to wish to shrug into submission