Germany Grapples with Escalation of Iranian Intelligence Activities

Germany is facing a heightened and evolving threat from Iranian intelligence services, according to recent assessments by German security agencies. Reports indicate a significant increase in espionage and influence operations targeting various sectors within the country, ranging from military installations to Iranian opposition figures residing in Germany. This intensified activity poses considerable challenges for German counter-intelligence efforts and raises concerns about the safety of individuals perceived as adversaries by the Iranian regime.

The escalation in Iranian intelligence operations is not a new phenomenon but has become notably more pronounced in recent years. Germany's domestic intelligence agency, the Federal Office for the Protection of the Constitution (BfV), has consistently described the presence of Iranian intelligence services across the country as "very active." This sustained vigilance has been met with a discernible uptick in incidents, prompting German authorities to issue warnings and implement enhanced counter-measures to address the multifaceted threat.

Mounting Evidence of Persistent Espionage

German intelligence agencies have observed a steady intensification of Iranian espionage activities. The Military Counter-Intelligence Service (MAD), for instance, has placed its personnel on heightened alert, specifically citing Iranian intelligence agencies as primary actors engaged in espionage against the Bundeswehr. This concern was further exacerbated by Iran's recent designation of the Bundeswehr and other European Union armed forces as "terrorist groups," a move seen as a direct response to the EU's decision to list Iran's Islamic Revolutionary Guard Corps (IRGC) on its terror list. German lawmakers and security experts are currently evaluating the potential for an elevated threat environment against German military installations and personnel, both domestically and abroad. Beyond traditional human intelligence threats, the MAD spokesperson indicated a substantial risk stemming from cyber-espionage, leading the agency to intensify its preventative strategies through comprehensive briefings and informational materials designed to raise awareness among soldiers.

The BfV has also confirmed a sharp rise in Iranian espionage activities, noting that the entire Iranian diaspora opposition within Germany is targeted, with specific groups like the National Council of Resistance of Iran (NCRI) being particularly exposed. These operations frequently extend to politically active Iranian exiles, journalists, and opposition figures residing in Germany. The actions taken against these individuals include surveillance, intimidation, and smear campaigns, with some instances reportedly escalating to direct threats of violence, abduction, or even assassination attempts, all aimed at suppressing dissent and controlling narratives.

Targeting Dissidents and Exploiting Vulnerabilities

A significant focus of Iranian intelligence efforts in Germany centers on monitoring and neutralizing perceived threats from the Iranian diaspora. Politically active Iranian exiles, journalists, and opposition figures are routinely subjected to surveillance, intimidation, and smear campaigns. Authorities have cautioned that such surveillance can serve as a precursor to more severe offenses. The German federal interior ministry has explicitly warned members of the Iranian diaspora in Germany about the risk of intimidation and harassment by Iranian state actors, including potential cyberattacks. This phenomenon is formally recognized as "transnational repression," referring to efforts by a state to monitor, threaten, or pressure opponents abroad. The ministry affirms that German authorities take any activity by foreign state bodies or their proxies in Germany with utmost seriousness, particularly when refugees are at risk.

One of the most insidious methods employed by Iranian intelligence involves the recruitment of informants, often through blackmail. Iran's Ministry of Intelligence is reportedly intensifying efforts to recruit dissidents in Germany by blackmailing their relatives in Iran. This recruitment process typically begins with agents seizing a relative's phone in Iran to access contacts abroad. They then exert pressure on the family and escalate to threatening to sabotage the exile's asylum case in Germany. Recruited informants are then tasked with attending opposition rallies and gatherings to identify active participants. An investigation by the Die Welt newspaper detailed specific instances where Iranian intelligence operatives used social media and messaging platforms like WhatsApp to coerce exiles into becoming "disposable informants." The National Council of Resistance of Iran (NCRI) has recorded 97 such cases in 2025 alone, describing this as an unprecedented escalation.

The Digital Battlefield: Cyber Espionage and "Charming Kitten"

The digital realm has emerged as a crucial battleground for Iranian intelligence operations in Germany. German intelligence services have issued warnings regarding state-sponsored Iranian cyber spies targeting dissident organizations and individuals. The Federal Office for the Protection of the Constitution (BfV) has reported concrete attempts by a hacking group known as "Charming Kitten" to target the Iranian opposition and exiles based in Germany.

Charming Kitten, also identified as APT35, has been described as state-sponsored by various cybersecurity companies, including Google, Recorded Future, and Proofpoint, based on its apparent intelligence-gathering rather than financial motivation. This group employs sophisticated social engineering techniques and creates false personal profiles tailored to victims, aiming to build rapport and subsequently compromise their targets. These tactics often involve sending links to online chats that lead to disguised credential harvesting pages. A similar warning was issued by Britain's National Cyber Security Centre, highlighting the international scope of Charming Kitten's activities. Human Rights Watch also reported in December that Charming Kitten was behind a well-resourced international cyber espionage campaign that targeted one of their staff members by inducing them to enter login credentials into a hacker-controlled webpage.

German Authorities Respond to the Expanding Threat

German authorities are actively working to counter the expanding Iranian intelligence presence. The federal interior ministry collaborates with federal security agencies to combat transnational repression in Germany and coordinates foreign policy measures with the foreign ministry. Individuals who suspect threats from state bodies or intelligence services are encouraged to contact the domestic intelligence agency confidentially. The German government continues to advocate within the European Union for the designation of Iran's Revolutionary Guards as a terrorist organization, with approval discussions ongoing.

The Military Counter-Intelligence Service (MAD) has also intensified its preventative strategies, including comprehensive briefings, advisory sessions, and informational materials for Bundeswehr personnel. These efforts aim to enhance soldiers' awareness of sophisticated methods used by foreign intelligence services and the inherent risks of espionage, facilitating early detection and neutralization of intelligence operations. Specialized support is also provided to military units and offices deemed particularly vulnerable to foreign intelligence activities, fostering heightened alertness and encouraging prompt reporting of suspicious incidents.

A Persistent and Evolving Challenge

The increasing targeting of Germany by Iranian intelligence presents a persistent and evolving challenge for German security services and the nation's democratic institutions. The scope of these activities, encompassing traditional espionage, cyber warfare, and the insidious practice of transnational repression, underscores a determined effort by the Iranian regime to extend its influence and suppress dissent abroad. The German government and its intelligence agencies continue to adapt their strategies, but the ongoing nature of these threats necessitates sustained vigilance, robust counter-intelligence measures, and strong international cooperation to safeguard national security and protect the rights of individuals within Germany's borders.