Iran's Shadow War: German Intelligence Grapples with Escalating Espionage Threat

BERLIN – German security agencies are confronting a growing and multifaceted threat from Iranian secret services, whose activities in Germany have intensified significantly, particularly in targeting Iranian dissidents, Jewish and Israeli interests, and engaging in sophisticated cyber espionage. Reports from Germany's domestic intelligence agency, the Federal Office for the Protection of the Constitution (BfV), consistently highlight the Islamic Republic's aggressive efforts to surveil, intimidate, and neutralize perceived opponents on German soil, raising serious concerns about national security and the safety of diaspora communities.

The intelligence landscape reveals a deliberate and expanding campaign by Tehran, utilizing both human intelligence and advanced cyber techniques to extend its reach into the heart of Europe. The German government and its allies are increasingly vocal in their condemnation, signaling a concerted effort to counter these clandestine operations that challenge the sovereignty and rule of law in Germany.

Intensified Surveillance and Intimidation of Dissidents

Since the widespread protest movements against the clerical rulers in Iran, particularly following the events of mid-September 2022, Iranian intelligence activities against exiled Iranians in Germany have seen a marked increase. The regime views opposition groups and individuals as a direct threat to its continued existence, making them primary targets for intelligence operations. German intelligence officials describe an aggressive pursuit of Iranian government opponents living abroad, aiming for their "intimidation," "neutralization," or even "punishment" as "traitors or defectors." This includes threats of abduction or assassination.

A particularly insidious method involves blackmailing dissidents by threatening their relatives still in Iran. Iranian agents frequently seize relatives' phones in Iran to access contacts abroad, subsequently pressuring family members to coerce exiles in Germany into becoming informants at opposition events. Victims often fear reporting these contacts to authorities due to concerns about losing their asylum status or being labeled regime collaborators. The National Council of Resistance of Iran (NCRI) documented 97 such cases in 2025 alone, indicating an unprecedented escalation of these tactics.

Targeting Jewish and Israeli Interests, and Broader Espionage

Beyond dissidents, a central pillar of Iranian intelligence operations targets organizations and individuals associated with "pro-Jewish and pro-Israeli goals." The German government explicitly states that Iran, alongside the USA, considers Israel and its supporters as enemies, extending this animosity to representatives of Jewish organizations in the diaspora. This threat is not merely theoretical; in July 2025, a Danish citizen was arrested in Germany on suspicion of spying for Iran, allegedly collecting information for a possible attack on Jewish institutions. German prosecutors believe the espionage was part of an assassination plot. Previous incidents include the Quds Force, an elite branch of the Iranian Revolutionary Guard Corps (IRGC) responsible for extraterritorial operations, hiring individuals to collect information on pro-Israel advocates in Germany, France, and other Western European countries. One such case involved a Pakistani student paid to surveil a former German MP who headed the German-Israeli parliamentary group.

The IRGC's Quds Force has been active in Germany for over a decade, with an estimated 160 individuals in Germany linked to the organization. These operations extend beyond physical surveillance and recruitment. Investigations have revealed substantial concerns about Iranian intelligence activities operating through networks linked to institutions such as the Islamic Mustafa Institute in Berlin. German intelligence services are scrutinizing around 700 individuals associated with its Berlin branch, which is alleged to function as a recruiting center for the Quds Force.

The Growing Menace of Cyber Espionage

In addition to traditional espionage, Iran has significantly expanded its cyberattack capabilities, posing a substantial danger to German companies, research institutions, and governmental bodies. Germany's BfV has repeatedly warned of increasing cyber and espionage threats from foreign powers, particularly listing Russia, China, and Iran as major concerns. Iranian cyber campaigns, characterized by their efficacy, are designed to gain information and can compromise German businesses and research.

A prominent player in this digital landscape is the "Charming Kitten" hacking group, also known by other designations, which has suspected ties to Iranian intelligence. This group employs sophisticated social engineering techniques, often targeting Iranian individuals and organizations in Germany. Their tactics typically involve building trust through online contact, often from spoofed accounts impersonating legitimate individuals or organizations, before luring targets into video chats or phishing schemes to compromise their accounts and steal sensitive data. These cyberattacks have primarily focused on dissident organizations, journalists, human rights activists, and professionals both within Iran and abroad. The U.S. intelligence community in 2023 warned that Iran's growing expertise and willingness to conduct aggressive cyber operations make it a major threat to the security of allied networks and data.

Germany's Counter-Measures and International Cooperation

The German government has demonstrated a firm stance against Iran's illicit activities. Federal Interior Minister Nancy Faeser has warned that the threat to Germany's democracy from espionage, sabotage, disinformation, and cyberattacks has reached a "new dimension," explicitly naming Iran as a key adversary alongside Russia and China. German authorities have taken concrete steps, including summoning Iran's ambassador over alleged espionage plots and banning organizations deemed to be direct representatives of Iran's Supreme Leader, such as the Islamic Centre Hamburg (IZH). In November 2023, authorities raided 54 locations connected to the IZH, citing its promotion of the Iranian regime's ideology and potential support for Hezbollah's activities.

Internationally, Germany is part of a broader coalition condemning Iran's state threat activities. In July 2025, alongside the United States, the United Kingdom, and numerous European nations, Germany issued a joint statement condemning attempts by Iranian intelligence services to kill, kidnap, and harass people in Europe and North America. These nations underscored that such actions violate their sovereignty and are often carried out in collaboration with international criminal organizations to target journalists, dissidents, and Jewish citizens. Germany has also increased cooperation with allies like Israel on cyber and security matters, aiming to bolster defenses against sophisticated cyber threats.

Historical Context and Ongoing Challenge

The threat posed by Iranian secret services in Germany is not a new phenomenon but one with historical precedents. The 1992 Mykonos restaurant assassinations in Berlin, where four Kurdish-Iranian dissidents were gunned down, were determined by German courts to have been ordered by the Iranian state. This history underscores the long-standing willingness of Iranian intelligence to conduct state-sponsored terrorism on European soil.

The ongoing and escalating nature of these activities presents a complex challenge for Germany. Protecting the Iranian diaspora, safeguarding Jewish and Israeli communities, and defending critical infrastructure and national interests from sophisticated state-sponsored threats require sustained vigilance and robust counter-intelligence measures. The German government's reports and actions indicate a clear understanding of the danger, signaling a continuous effort to adapt and strengthen its defenses against Iran's persistent shadow war.