Iranian intelligence services and Revolutionary Guards operatives are recruiting teenagers through criminal intermediaries to launch a wave of low-level “hybrid warfare” attacks in Europe and the UK, according to investigators, security officials, analysts and police documents.

A first wave of attacks was launched in early March, 10 days after the US and Israel began strikes on Iran, and targeted Jewish community sites in Belgium, the Netherlands and US banks. A second wave has focused on the UK, with a series of arson and attempted arson attacks on synagogues, a Jewish charity and the offices of an Iranian opposition TV network in London.

On Tuesday, British police said they had arrested seven people for allegedly plotting a further firebombing, and a teenager pleaded guilty to an arson attack on a synagogue in west London on Saturday.

Analysts and security officials say that although there is no direct proof of Iran’s involvement, multiple factors strongly suggest the attacks are part of a campaign of hybrid warfare launched by Tehran to destabilise US allies and warn of them potential cost of greater involvement in the conflict, while also harming Jewish communities seen as supportive of Israel.

Julian Lanchès, of the International Centre for Counter-Terrorism in The Hague, said: “We don’t have any absolute evidence that Iran is involved or that someone else is behind [the attacks] but it seems very unlikely that a new terrorist group has simply emerged out of nowhere, and a number of factors point to Iran.”

The 17 attacks recorded so far in Europe all appear to have been organised in a similar way against similar targets, suggesting some kind of central command and control, and the tactics used recall many previous attacks that involved Iran.

The MI5 director general, Ken McCallum, said in October that the service had tracked more than 20 potentially lethal Iran-backed plots in the UK in 12 months.

On 18 March, two individuals were charged under the National Security Act for allegedly conducting hostile surveillance of Jewish community sites in London on behalf of an Iranian intelligence service. The charges related to alleged hostile surveillance activity in July and August 2025.

In Australia, security officials blamed a series of antisemitic attacks in 2025, including against a cafe and a synagogue, on Iran. Intelligence services in the Netherlands and Spain told counterparts in the UK and elsewhere of failed assassination attempts directed against Iranian dissidents, McCallum said.

The nature of attacks in recent weeks is familiar to European services, who have reported for several years that Iran has relied on criminal networks to recruit low-level “disposable” operatives motivated by the opportunity to earn relatively small amounts of money, who appear to have a limited understanding of the nature of their target and no knowledge of their ultimate paymaster.

A former drug dealer detained in France in 2024 after conducting surveillance on a Jewish businessman’s home in Munich said he had been recruited via Snapchat by a former cellmate to help with a “fraud case” and paid €1,000.

In Paris last month, a 17-year-old arrested on suspicion of planting a makeshift bomb in front of a branch of Bank of America told police he had been recruited via Snapchat group where he usually got commissions to deliver drugs. A “Mr Big” had said he wanted to intimidate the unfaithful girlfriend of a friend and offered between €1,000 and €1,400 to the teenager and two other recruits if they ignited a firework in front of the woman’s home and filmed the scene, according to a police statement obtained by Le Monde.

Laurent Nuñez, the French interior minister, made a “direct link” to Iran after the attempted attack. “Typically, the intelligence services of this country [Iran] operate in this way: they use proxies, a series of subcontractors, often common criminals, to carry out highly targeted actions aimed at US interests, the interests of the Jewish community, or Iranian opposition figures,” Nuñez said.

On Tuesday a 17-year-old boy pleaded guilty to arson not endangering life over an attack on Kenton united synagogue in west London. Westminster magistrates court heard that he clambered over a wall and broke a window, and then a lit object was thrown into the synagogue.

An accomplice, one of two being sought by police, filmed the attack and the footage released on social media by a group called Harakat Ashab al-Yamin al-Islamia (HAYI) in a video claiming responsibility.

In an interview, the youth told police he had not meant to hurt anyone. “I have no hate towards the Jewish people of their community. I didn’t know it was a synagogue. I genuinely thought it was an empty building,” he said. He was released on bail with conditions including staying away from synagogues pending his next court hearing in June.

Since the attacks in the UK started, 23 people have been arrested and police say seven have been charged with arson-related offences.

The Metropolitan police deputy commissioner, Matt Jukes, said it had been “an extraordinary period”. He said: “We’ve sadly seen hate crime in our communities before, we’ve seen radicalisation towards terrorism … But now what we’ve got is the prospect of a foreign state actually using that as a mechanism to sow discord, discontent and to create anxiety in our communities.”

Lanchès said the profile of many of those detained in Europe and the UK suggested that few if any were “ideologically driven”. “This is odd and there is no evidence of any internal organisational structure either so this rather speaks against a genuine terrorist group being responsible.”

Investigators also point out that HAYI, the supposed organisation that has claimed the attacks, was unknown before the war against Iran, appearing for the first time in early March in a post on social media channels associated with Iran-backed Islamist militia in Iraq. A second post claimed responsibility for the bombing of a synagogue in Liège, Belgium, on 9 March.

Imagery in the claims of responsibility by HAYI closely resembles that used by the Iran-aligned Iraqi militia, experts say.

Phillip Smyth, a US-based expert in Shia militia groups and Iranian external operations, said: “This is the same strategy that was pioneering by Iran in Iraq, Bahrain and Syria and they are now using in Europe … Partly the aim is to cause confusion and analysis paralysis.”

Though there are fears of escalation if the fragile ceasefire in the Middle East breaks down, the attacks in Europe and the UK so far have been carefully calibrated to avoid casualties. The priority appears to be to sow chaos and anxiety while attracting media attention.

Smyth said: “If you generate enough coverage, you can claim you have greater capabilities than you actually do … It’s all a part of keeping it confusing.”