Iranian Intelligence Operations in Scandinavia: A Growing Security Threat

Iran­ian intel­li­gence oper­a­tions in Scan­di­navia have esca­lat­ed sig­nif­i­cant­ly, with author­i­ties in Den­mark and Nor­way iden­ti­fy­ing increased sur­veil­lance, crim­i­nal proxy recruit­ment, and poten­tial ter­ror plots. On 25 Sep­tem­ber 2025, Eura­sia Review report­ed that Iran­ian intel­li­gence ser­vices posed a grow­ing secu­ri­ty threat through sophis­ti­cat­ed oper­a­tions tar­get­ing Scan­di­na­vian coun­tries, detail­ing how Iran­ian oper­a­tives exploit crim­i­nal net­works and con­duct influ­ence oper­a­tions against regime crit­ics and Israeli inter­ests. The arti­cle begins:

The Islam­ic Repub­lic of Iran (IRI) has a long­stand­ing his­to­ry of con­duct­ing intel­li­gence oper­a­tions beyond its bor­ders and tar­get­ing both polit­i­cal oppo­nents and for­eign gov­ern­ments. Since the 1979 Islam­ic Rev­o­lu­tion, the regime has sought to expand its influ­ence and sup­press dis­sent through a com­bi­na­tion of covert activ­i­ties, such as ter­ror­ism, espi­onage, cyber oper­a­tions, and influ­ence cam­paigns. While sig­nif­i­cant atten­tion has been giv­en to the IRI’s intel­li­gence activ­i­ties in the Mid­dle East, North Amer­i­ca, and West­ern Europe, its oper­a­tions in Scan­di­navia have received com­par­a­tive­ly less scruti­ny. This report ana­lyzes the IRI’s intel­li­gence oper­a­tions in Scan­di­navia with a focus on Den­mark and Nor­way. Due to their small­er size and rel­a­tive­ly lim­it­ed polit­i­cal influ­ence with­in the Euro­pean Union (EU), these coun­tries are often over­looked in dis­cus­sions of Tehran’s for­eign intel­li­gence activ­i­ties. This lack of atten­tion on the part of the EU, com­bined with Denmark’s and Norway’s weak gov­ern­men­tal response, has led the IRI to oper­ate more freely in the region. Rather than deter­ring Tehran, the absence of firm con­se­quences from these actors has sig­naled that the cost of expo­sure in Scan­di­navia remains low.

Read more: https://www.eurasiareview.com/25092025-a-growing-security-threat-iranian-intelligence-operations-in-scandinavia-part-one-denmark-and-norway-analysis/

Key Points

• Iran­ian intel­li­gence ser­vices use crim­i­nal net­works as prox­ies to con­duct sur­veil­lance and attacks in Swe­den and Denmark.

• Nor­we­gian author­i­ties assess Iran employs ter­ror as for­eign pol­i­cy tool through proxy actors includ­ing criminals.

• Swedish secu­ri­ty police warn of esca­lat­ing Iran­ian activ­i­ties tar­get­ing oppo­si­tion fig­ures and Israeli interests.

• Iran­ian oper­a­tions focus on sup­press­ing dis­si­dents, acquir­ing dual-use tech­nol­o­gy, and cir­cum­vent­ing inter­na­tion­al sanctions.

Iranian Influence Operations: A Threat to Democratic Order in Europe

Iran’s regime is expand­ing its oper­a­tional reach with­in Europe, sys­tem­at­i­cal­ly tar­get­ing polit­i­cal and media oppo­nents in a cam­paign that lever­ages cyber offen­sives, sur­ro­gate influ­ence net­works, and clan­des­tine polit­i­cal oper­a­tions. Iran­ian cyber actors have orches­trat­ed large-scale dig­i­tal assaults against oppo­si­tion media, com­pro­mis­ing sen­si­tive data and poten­tial­ly enabling fur­ther harass­ment or intel­li­gence-gath­er­ing against Iran­ian dis­si­dents and jour­nal­ists in the dias­po­ra. Con­cur­rent­ly, ana­lysts have detect­ed Iran­ian-linked bot net­works manip­u­lat­ing pub­lic opin­ion on con­tentious Euro­pean polit­i­cal issues, reflect­ing Tehran’s bid to exploit West­ern social divi­sions and ampli­fy nar­ra­tives that under­mine Euro­pean cohesion.

In the Unit­ed King­dom, Iran­ian-linked actors have orches­trat­ed hybrid shad­ow warfare—combining dis­in­for­ma­tion, cyber intru­sions, and phys­i­cal threats against jour­nal­ists and oppo­si­tion fig­ures—while exploit­ing legal and finan­cial loop­holes to embed influ­ence with­in British insti­tu­tions. The Islam­ic Repub­lic of Iran Broad­cast­ing (IRIB) remains cen­tral to these efforts, blend­ing state media with forced con­fes­sions and inter­na­tion­al pro­pa­gan­da to rein­force Tehran’s ide­o­log­i­cal objec­tives. As West­ern intel­li­gence agen­cies and tech firms dis­rupt these cam­paigns, Iran’s adapt­abil­i­ty and inte­gra­tion of new tech­nolo­gies con­tin­ue to pose a per­sis­tent threat to infor­ma­tion integri­ty and demo­c­ra­t­ic resilience world­wide, with oper­a­tional link­ages span­ning from tar­get­ed cyber­at­tacks on oppo­si­tion media to the manip­u­la­tion of polit­i­cal dis­course in key Euro­pean states.

Exter­nal references:

• Iran­ian Exter­nal Oper­a­tions in Europe: The Crim­i­nal Connection
• Nor­we­gian Nation­al Threat Assess­ment 2025
• Iran­ian Covert Action in Scan­di­navia: Swedish Gangs as Proxies

Dis­claimer

The Glob­al Influ­ence Oper­a­tions Report (GIOR) employs AI through­out the post­ing process, includ­ing gen­er­at­ing sum­maries of news items, the intro­duc­tion, key points, and often the “con­text” sec­tion. We rec­om­mend ver­i­fy­ing all infor­ma­tion before use. Addi­tion­al­ly, images are AI-gen­er­at­ed and intend­ed sole­ly for illus­tra­tive pur­pos­es. While they rep­re­sent the events or indi­vid­u­als dis­cussed, they should not be inter­pret­ed as real-world photography.