The internal security logic of the Islamic Republic of Iran has undergone a violent migration. For decades, the regime’s efforts to silence dissent were largely contained within its borders or executed by specialized operatives in the shadows of European capitals. Today, that strategy has evolved into a high-volume, franchised operation that effectively outsources assassination and intimidation to the global criminal underworld.
By shifting from using "clean" sovereign agents to "dirty" local proxies—including drug cartels, biker gangs, and low-level street criminals—Tehran has created a system of plausible deniability that challenges the traditional response capabilities of Western intelligence. This is no longer just a war on dissidents; it is a stress test for the sovereignty of every nation hosting an Iranian diaspora.
The Mechanization of Repression
The shift in tactics is driven by a cold, mathematical necessity. Traditional intelligence officers are easy to track, their movements flagged by passport controls and diplomatic surveillance. When a member of the Islamic Revolutionary Guard Corps (IRGC) or the Ministry of Intelligence and Security (MOIS) is caught with a weapon in London or Washington, it triggers a diplomatic crisis.
When a local gang member with a rap sheet for narcotics does the job, the motive is obscured. It looks like a robbery gone wrong or a localized gang dispute. This "Outsourcing Model" was most visible in the 2024 stabbing of journalist Pouria Zeraati outside his home in London. The attackers were not Iranian nationals but hired muscle, fleeing the country within hours.
This evolution is spearheaded by Unit 840 of the IRGC-Quds Force. This unit does not just execute hits; it functions as a procurement office for international violence. They scout for vulnerabilities in Western security, identify targets—ranging from high-profile satirists to obscure human rights activists—and then "bid" the job out to organized crime syndicates.
Digital Fingerprints and Physical Tolls
The infrastructure of this covert war relies heavily on digital surveillance. Before a physical attack occurs, a target is typically subjected to a "Digital Encirclement." This involves:
- Phishing and Social Engineering: Using fake personas to gain the trust of activists and map their physical movements.
- Family Ransom: Interrogating the relatives of dissidents still living in Iran to extract addresses and daily routines of those abroad.
- Commercial Spyware: Leveraging vulnerabilities in mobile devices to turn a target’s phone into a tracking beacon.
In May 2025, UK authorities disrupted a plot involving four Iranian nationals and several local accomplices targeting the Israeli embassy and affiliated individuals. The complexity of these operations has increased. The regime is now comfortable running multiple, concurrent plots across different continents, betting that Western counter-terrorism units cannot keep pace with the sheer volume of "low-cost, high-impact" threats.
The Azerbaijan Precedent
If you want to see the blueprint for the next decade of Iranian operations, look at the Caucasus. Between 2023 and 2025, Azerbaijan became a primary laboratory for Tehran’s destabilization tactics. The plot to assassinate MP Fazil Mustafa and the later conspiracy against Rabbi Sneor Segal in Baku utilized Georgian drug traffickers and local radicals.
The payment for these hits often bypasses the formal banking system entirely. Agents use Hawala networks or cryptocurrency to move hundreds of thousands of dollars to criminal recruits. In the Segal case, a Georgian trafficker was reportedly offered $200,000 for the kill—a pittance for a state actor, but a life-changing sum for a regional criminal. This commoditization of political murder makes every disgruntled street soldier in a foreign city a potential asset for Tehran.
The Failure of Traditional Deterrence
Western governments have responded with the standard toolkit: sanctions, travel bans, and the occasional diplomatic expulsion. However, these measures are increasingly toothless against a regime that has already been sanctioned to the limit. When the U.S. and UK sanctioned members of Unit 840 in early 2024, it was a symbolic victory with little operational impact. The operatives in question rarely travel to the West under their own names, and their assets are not held in London or New York banks.
The "Red Line" has moved. The June 2025 conflict and the subsequent spike in executions within Iran—reaching their highest levels since the 1980s—show a regime that no longer fears international pariah status. They view the diaspora as an existential threat, a "soft war" being waged by the West through the medium of Persian-language media and social media activism. In their eyes, a stabbing in a London suburb is a defensive measure.
The Burden on the Diaspora
The psychological impact of this strategy is the true objective. For an Iranian activist in Glendale or Stockholm, the threat is no longer a distant "secret police" but the person in the car parked at the end of the block. By using local criminals, Tehran ensures that its enemies can never feel truly safe, even in the most secure democracies.
This environment has forced a radical change in how dissident groups operate. Secure houses, private security details, and extreme digital hygiene are now the baseline requirements for political expression. The cost of dissent is no longer just the risk of never going home; it is the risk of being followed home in a city thousands of miles away.
The international community must decide if "transnational repression" is a secondary human rights concern or a primary national security threat. As long as criminal gangs can be bought for the price of a mid-range luxury car, the borderless war will continue to expand. The silence of a critic is worth more to Tehran than the diplomatic cost of a failed hit.
Stop looking for the "spy" in the trench coat. Start looking for the local fixer with a crypto wallet and a burner phone.
