From assassinations and cyberattacks to alliances with local gangs, Iran is waging a quiet but coordinated intelligence campaign across Denmark, Norway, and Sweden — with Europe slow to respond.
Iran’s intelligence services have long extended their reach far beyond the Middle East. Since the 1979 revolution, Tehran has relied on espionage, cyber intrusions, assassinations, and influence campaigns to suppress opponents abroad and gather strategic knowledge.
While the Middle East and North America attract most scrutiny, Scandinavia has quietly become one of Iran’s most active theaters of covert operations.
Recent cases in Denmark, Norway, and Sweden show that Tehran treats the region not as peripheral but as a low-cost, high-value arena. These countries’ advanced universities, cutting-edge industries, and politically active Iranian diaspora communities make them prime targets.
Denmark and Norway: Silencing Dissidents, Hitting Israel
Denmark has been a hub for Iranian cyber-espionage. Security officials say Iranian hackers have repeatedly targeted universities, aiming to steal sensitive research with military and surveillance applications. The hacking group “Silent Librarian,” tied to the Revolutionary Guard, has attacked academic databases across Europe under academic pretenses.
But cyber theft is only part of the story. In 2018, Danish authorities uncovered a plot to assassinate Habib Yabor Kabi, leader of an Arab separatist group opposed to Tehran.
A Norwegian-Iranian operative was convicted of scouting the target. The episode demonstrated Tehran’s willingness to eliminate opponents on European soil.
The following years saw Iranian networks strike at Israeli interests. In 2024, a Swedish gang tied to Tehran attempted to attack Israel’s embassy in Copenhagen, highlighting how Iran co-opts organized crime for deniable operations.
Norway, too, has lived under the shadow of Iranian operations. The 1993 shooting of publisher William Nygaard, who printed Salman Rushdie’s The Satanic Verses, remains widely linked to Tehran’s agents. More recently, Norwegian authorities expelled an Iranian suspected of preparing an attack on a pro-Israel activist. Iranian clerics tied to intelligence networks have used mosques in Oslo to monitor dissidents, while cyber intrusions target opposition groups.
Sweden: The Central Stage
Sweden has emerged as the most exposed. In 2021, authorities arrested an Iranian couple who had lived quietly in the country for six years before being activated to map Jewish community targets — a classic “sleeper agent” case.
Attacks on Israel’s embassy in Stockholm in 2024, traced to the Foxtrot gang led by a figure now based in Iran, reinforced concerns that Tehran has fused intelligence with Europe’s gang wars.
Iran has also sought to inflame Sweden’s politics. After Quran burnings in 2023 sparked outrage, Iranian cyber units hacked a local SMS service to send 15,000 messages urging revenge. Months later, Salwan Momika, the man behind the burnings, was gunned down in his home — raising questions about whether Tehran’s campaign helped set the stage.
Stockholm’s think tanks and universities have also seen infiltration. A government-funded institute’s director was revealed to have been in contact with a Tehran-run influence network, while researchers with embassy ties were expelled.
Other operatives tried to acquire dual-use technologies with potential applications in weapons programs.
A Coordinated Strategy
Taken together, these incidents show a consistent pattern. Iran’s goals are clear: suppress dissidents, intimidate diaspora activists, target Israeli and Jewish communities, and bypass sanctions by stealing advanced knowledge.
Its toolbox is wide — embassies, mosques, criminal gangs, cyber warfare, and sleeper agents.
This activity also connects directly to Tehran’s partnership with Moscow. Both regimes coordinate cyber tactics and intelligence operations, united by a desire to weaken Europe. Iran’s drones already support Russia’s war in Ukraine; its covert work in Scandinavia helps probe NATO’s northern flank.
Why It Matters
For too long, Denmark, Norway, and Sweden have treated these operations as isolated incidents. In reality, they are part of a coordinated campaign orchestrated by Iran’s Revolutionary Guard and Ministry of Intelligence. Scandinavian governments now flag Iran as a top-tier threat, but their policy responses remain fragmented.
The lesson is stark: Europe’s smaller democracies are not bystanders. They are frontlines in a shadow war that blends espionage, propaganda, cyber intrusions, and targeted violence.
Unless governments act collectively — shutting down Tehran-linked institutions, tightening academic and diplomatic oversight, and pressing the EU to designate the Revolutionary Guard a terrorist organization — the Islamic Republic will continue to see Scandinavia as open ground.
Iran’s campaign in the north is not simply about silencing its exiles. It is about projecting power into Europe itself, in tandem with Russia, and shaping the global contest between authoritarian states and the West.
