A look at the Iran and Russia-linked hybrid attacks the U.K. spy chief says are flourishing

London — The head of Britain’s top domestic spy agency MI5, Sir Ken McCallum, painted a dark picture Tuesday of the changing national security threats facing the U.K. and the world. 

“We have entered a new era of national security, requiring a new response,” he said in his annual threat update at MI5 headquarters in London.  “Those who mean the U.K. harm aren’t attacking things government owns or controls … They’re aiming at people, businesses, communities.” 

McCallum said that among state threats, “Russia remains aggressor number one,” while intelligence analysts have also seen a “major shift” in “Iranian ambitions to come at harder targets.” 

Both countries, he said, have adopted more and evolving “hybrid tactics” as they target everything from air force bases to synagogues across the U.K. and Europe. Below is a look at some of the incidents that fit that description over the last year alone.

Iran

Iran has used and continues “using criminal proxies to try to intimidate oppositionists, Iranian media organizations, and Israeli sites,” McCallum said. 

But analysts have also seen “Iran, like Russia, attempting to expand their hybrid campaign,” he said, leading to more than 50 arrests in the U.K. over the last year alone. 

“Sadly, much of this aggression has been aimed at British Jewish communities,” McCallum said, speaking of incidents this year that included “a wave of arson and sabotage incidents targeting Jewish communities in the U.K. and other European nations,” but also acts targeting “harder targets, like military sites.”

Many of these attacks were claimed by a group calling itself Harakat Ashab al-Yamin al-Islamiya (HAYI), or the Islamic Movement of the Companions of the Right, which U.K. authorities have sanctioned and said is tied directly to the elite Quds Force of Iran’s Islamic Revolutionary Guard Corps, which Britain considers a terrorist organization. 

A CBS News investigation in March found the group appeared to have links to Iran, and a member said it would “keep threatening U.S. and Israeli interests worldwide until we’ve avenged every child in Gaza, Iran, Lebanon, and the resistance nations … We urge people to stay away from Zionist and American interests and individuals to keep themselves safe.”

These Iran-linked attacks include:

• Liège, Belgium: March 9. An explosive device detonated at a synagogue, causing no casualties. Attack claimed by HAYI.
• Rotterdam, The Netherlands: March 13. The firebombing of a synagogue. Attack claimed by HAYI. Dutch authorities say they’re investigating Iranian links to the incident.
• Amsterdam, The Netherlands: March 14. A device detonated outside a Jewish school. Attack claimed by HAYI.
• Golders Green, London: March 23. Four ambulances belonging to a Jewish volunteer ambulance service set on fire. Attack claimed by HAYI.
• Antwerp, Belgium: March 24. A car set on fire in a Jewish quarter of the city. Attack claimed by HAYI.
• Paris, France: March 28. 17-year-old allegedly tries to place an explosive device at the Bank of America headquarters. French authorities suspect HAYI was behind the attack, though the link was not confirmed. 
• Nijkerk, The Netherlands: April 4. A device detonated outside the premises of a group called Christians For Israel. Attack claimed by HAYI.
• Finchley, London: April 15. Molotov cocktails and a brick thrown at Finchley Reform Synagogue. Attack claimed by HAYI.
• Park Royal, London: April 15. An attempted arson attack against Persian-language news outlet Iran International. Responsibility for the incident was never claimed. In March 2024, a journalist for the channel, Pouria Zeraati, was stabbed outside his home in London. According to The Guardian, counterterrorism police and security services in Britain believed the Iranian regime used criminal proxies to carry out the attack.
• Hendon, London: April 17. Attempted arson at the former premises of charity Jewish Futures. Attack claimed by HAYI.
• Harrow, London: April 18–19. A suspected arson attack at a synagogue in Harrow, then a bottle containing accelerant was thrown at the Kenton United Synagogue a day later. Attack claimed by HAYI.
• Golders Green, London: April  29. Two Hasidic Jewish men stabbed in the north of the capital. Attack claimed by HAYI.
• RAF Fairford, England: Sept. 27. Suspected plot involving British base used by U.S. bombers to strike Iran. Gasoline was found in vehicles, but no viable explosives. British Prime Minister Andy Burnham said the incident was “almost certainly” directed by Iran.
• Manchester, England: Oct. 2. Two Iranian nationals are charged with terrorism offenses following an alleged plot targeting a Jewish community in the northern city of Manchester. 

Russia

For now, Russia remains the biggest threat to security, according to the U.K. spy chief’s Tuesday briefing.

“The Russian military and intelligence services are once again escalating their attempts at hybrid warfare,” McCallum said, adding that Moscow was “being careful to stay below the NATO Article 5 threshold” with its actions, which would trigger the alliance’s collective defense principle.

“It’d be foolish for them to cross” that line, he said, and so far Russia “is using tactics that stop short – though sometimes not much short – of conventional conflict.”

Incidents linked to Russia this year include:

• Off Vaindloo Island, Estonia: March 19. Russian SU-30 fighter allegedly violates Estonian airspace – NATO scrambles aircraft in response. 
• Hutthurm, Germany: March. Authorities thwarted a Russian-ordered assassination attempt targeting the head of a Germany defense company, according to Die Zeit.
• Norwegian waters, near the U.K.: Reported April 9. The U.K. and Norway deployed military vessels to deter Russian submarines found to have lingered for over a month from attacking undersea cables. Over the last few years there have been several incidents of alleged Russian sabotage of such cables. 
• Labege, France: June 1. Molotov cocktails thrown at a drone factory that supplies the French and Ukrainian armed forces. French authorities are investigating Russian links, according to Le Monde.
• Leipzig, Germany: Aug. 4. An explosive-laden drone is found near cargo facilities and Ukrainian aircraft. German authorities explicitly attributed the incident to Russia.
• Skarzysko-Kamienna, Poland: August. Fire at a WB Electronics factory that produces drones and other military components. EBU reports that authorities believe Russia used “low-level operatives” to carry out the attack, but authorities do not identify those responsible.
• Tallinn, Estonia: Aug. 15. Arson attack on Milrem Robotics, a defense company that supplies robotic military vehicles to Ukraine. Estonian authorities attributed the attack to Russia in late September.
• Swindon, England: Sept. 9. Joshua Cammidge charged over allegedly sharing locations of drone factories with people linked to Russian military intelligence and offering to carry out sabotage attacks.
• Wola Krobowska, Poland: Sept. 23. Arson attack on a Starlink satellite ground station, which Poland officially blames on Russia in October.
• Lithuania, September. Drone carrying explosive device crossed Belarusian border is shot down by NATO aircraft. Italian defense minister says it “most probably” came from Russia. 
• Denmark: Oct. 7. A Danish intelligence official says Russia attempted acts of sabotage against defense industry companies supplying Ukraine over summer.