May 10, 2026
JISS - Iran’s Sleeper Networks, False Flags and the ISIS-K Question: How Tehran Operates in the Caucasus and Europe

Anyone who still views Iranian terrorism abroad as a Shiite affair carried out by Hezbollah operatives on orders from Tehran is reading from a script Tehran itself abandoned long ago. In 2026, the Islamic Republic’s overseas operations structure looks more like a layered ecosystem than a chain of command: Islamic Revolutionary Guard Corps–Quds Force (IRGC-QF) and Ministry of Intelligence (MOIS) officers at the top, Lebanese Hezbollah and aligned Shiite networks in the middle, and a wide periphery of criminal gangs, sympathizers groomed online, local recruits, teenagers, and—when convenient—Sunni jihadists or non-Iranian actors at the bottom. The point of this architecture is not ideological purity but plausible deniability.
British officials no longer hide their assessment. The UK government’s September 2025 response to the Intelligence and Security Committee’s Iran report stated bluntly that the physical threat posed by Iran has grown sharply since 2022, that MI5 and the police have responded to twenty Iran-backed plots presenting potentially lethal threats, and that Iranian intelligence services increasingly use organized criminal gangs abroad. The same logic is at work in the South Caucasus. In January 2026, Azerbaijan’s State Security Service announced the arrest of three Azerbaijani citizens who had approached a foreign embassy in Baku after entering, in the official phrasing, “criminal relations” with the ISIS Khorasan (ISIS-K) group. Reporting from both Israeli sources and Reuters clarified that the foreign embassy was Israel’s, without verifying the assailants’ possible affiliation.
Read the full article on the Jerusalem Institute of Strategic Studies.
Alex Grinberg is a Senior Fellow at the Turan Research Center.