Executive Overview
For decades, political dissidents, journalists, and exiles who fled state repression in Iran operated under the assumption that crossing international borders offered a degree of safety. That assumption has dissolved. Over the past five years, the Islamic Republic of Iran has dramatically expanded a campaign of transnational repression, weaponizing global criminal underworlds to stalk, intimidate, kidnap, and assassinate critics living in Western capitals.
Rather than deploying trained intelligence officers whose capture would trigger diplomatic crises, Tehran’s intelligence apparatus—specifically the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence—has increasingly outsourced violent operations to foreign criminal syndicates. From Russian mobsters and Hells Angels bikers to Romanian mercenaries and disaffected teenagers recruited via social media apps, these disposable proxies provide the regime with a veneer of plausible deniability.
The operational objective extends beyond immediate body counts. By orchestrating surveillance, arson, and violent assaults on foreign soil, the Iranian state instills widespread terror within the diaspora, signaling that geographic distance offers no refuge. The high-profile stabbing of Iranian dissident journalist Pouria Zeraati outside his London home in March 2024 serves as a stark blueprint of this strategy—highlighting both the intricate mechanics of Iran’s outsourced terror network and the immense challenge it poses to Western national security and law enforcement agencies.
Read Also
Detailed Chronology: The Stalking and Stabbing of Pouria Zeraati
From London Studios to Tehran’s Target List
Pouria Zeraati, 38, arrived in the United Kingdom in 2007 to pursue a degree in mechanical engineering before transitioning into broadcast journalism. He joined Manoto, a popular Persian-language satellite channel, where he developed a sharp, opinionated anchoring style. In 2022, Zeraati assumed the host position for "The Last Word," a flagship Friday-night public affairs program on Iran International, an independent satellite network critical of the Iranian government.
+-----------------------------------------------------------------------------------+
| TIMELINE OF THE ZERAATI CASE |
+-----------------------------------------------------------------------------------+
| 2007 - Pouria Zeraati arrives in the UK to study mechanical engineering. |
| 2017 - Iran International launches from London to counter state censorship.|
| Sept 2022 - "Woman, Life, Freedom" protests erupt across Iran. |
| Late 2022 - Iranian authorities designate Iran International a "terrorist org." |
| Early 2023 - Romanian operative George Stana arrested near Zeraati's home with |
| bat/scissors; released due to lack of immediate evidence. |
| March 2024 - Zeraati is stabbed three times outside his London residence by |
| hired Romanian nationals who immediately flee the UK. |
| Late 2024 - Stana and accomplice Nandito Badea extradited to the UK; convicted |
| at the Old Bailey and sentenced to 12 and 8 years in prison. |
+-----------------------------------------------------------------------------------+The launch of the nationwide "Woman, Life, Freedom" protest movement in September 2022—sparked by the death of 22-year-old Mahsa Jina Amini in moral police custody—transformed Iran International into a crucial information hub for millions inside Iran. Zeraati’s broadcasts featured persistent coverage of street demonstrations, critical interviews with Israeli officials and Western policy makers, and outspoken commentary calling for an end to clerical rule.
In response, Iranian Intelligence Minister Esmail Khatib declared Iran International a "terrorist organization" and designated its journalists as national security threats. Fars News Agency, affiliated with the IRGC, published a hit list featuring headshots of Zeraati and four colleagues labeled "WANTED: DEAD OR ALIVE."
The Surveillance and Reconnaissance Phase
For nearly two years, Zeraati collected evidence of systematic harassment:
- Harassing communications flooded his phone and email daily.
- Masked men staged surveillance outside his residence in Wimbledon, South London.
- Two men on a motorcycle trailed his wife on the street, threatening her in Farsi.
- An anonymous Telegram user alerted Zeraati that money had been offered to harm him.
Though Metropolitan Police installed residential alarms and temporarily relocated Zeraati and his wife to a safe house, surveillance continued.
In early 2023, local police disrupted a dry run when neighbors reported two men in medical masks lurking in the garden behind Zeraati’s building. Officers arrested 22-year-old Romanian national George Stana, who was carrying a baseball bat and heavy-duty scissors. Text messages recovered from Stana’s phone showed instructions from an anonymous handler nicknamed "Em," specifying Zeraati’s apartment number and instructing: "Make sure he is alone. Hope you do it today."
Due to insufficient evidence linking Stana directly to a violent conspiracy at the time, he was released and immediately returned to Bucharest.
The Financial Trail and Logistics
The apparatus behind the operation extended far beyond the local operatives. British financial intelligence later traced a complex funding mechanism designed to support the hit team:
- Corporate Fronts: Payments were funneled through Hemroc Ltd., a UK-registered enterprise linked to Edgar Hakkopian, an Iranian businessman residing in London who had previously secured British citizenship.
- Capital Transfers: Hemroc Ltd. transferred the equivalent of more than $100,000 to Florina Stana, the sister of George Stana.
- Field Logistics: Florina wired funds back to the surveillance team in London to cover SIM cards, tactical gear, lodging, and a blue Mazda getaway vehicle.
Over the course of several weeks in early 2024, Stana returned to London accompanied by two other Romanian nationals, Nandito Badea (19) and David Andrei, executing at least eight recorded reconnaissance trips to monitor Zeraati’s daily routine.
[Iranian Intelligence / IRGC Unit 840]
|
v
[Edgar Hakkopian / Hemroc Ltd.] (UK Front)
|
v (>$100k Wire Transfers)
[Florina Stana] (Bucharest)
|
v (Operational Funds)
+--------------+--------------+
| |
v v
[George Stana] [Nandito Badea & David Andrei]
(Driver / Coordinator) (Physical Assault Team)The March 2024 Attack and Flight
On Friday, March 29, 2024, at approximately 3:00 PM, Zeraati exited his home to commute to the newsroom. As he approached his vehicle, Nandito Badea intercepted him under the pretext of asking for "three pounds." Simultaneously, David Andrei ambushed Zeraati from behind.
While one attacker restrained him, the other plunged a knife three times into Zeraati’s right leg. The assailants fled toward the waiting Mazda driven by Stana. A neighbor used a construction tool belt as an emergency tourniquet to stanch Zeraati’s arterial bleeding until paramedics arrived.
The attack team drove to a nearby area, abandoned the getaway car, disposed of their outer clothing in public waste bins, and took a taxi directly to London Heathrow Airport. Within hours of the stabbing, all three operatives had boarded flights to Geneva, eventually connecting back to Bucharest.
Judicial Accountability at the Old Bailey
Nine months after the assault, British authorities successfully extradited George Stana and Nandito Badea from Romania to stand trial at the Central Criminal Court (the Old Bailey) in London. (David Andrei remained subject to separate judicial proceedings in Bucharest).
During the trial before Judge Bobbie Cheema-Grubb, the defense argued that the young men were "disposable tools"—functionally illiterate workers who believed they were hired to settle a domestic dispute for cash. However, prosecutors presented extensive cell tower telemetry, encrypted chat logs, and financial records proving a deliberate, organized conspiracy linked to foreign intelligence interests.
+----------------------------------------------------------------------------------+
| VERDICT & SENTENCING SUMMARY |
+----------------------------------------------------------------------------------+
| Presiding Judge : Bobbie Cheema-Grubb (Old Bailey, London) |
| Primary Finding : "A targeted, organized, and funded act of serious violence |
| carried out for reward... on behalf of a foreign power." |
+----------------------------------------------------------------------------------+
| Defendant | Role | Verdict | Sentence |
+-----------------+--------------------------+---------+---------------------------+
| George Stana | Logistics & Getaway Driver| Guilty | 12 Years Imprisonment |
| Nandito Badea | Physical Assailant | Guilty | 8 Years Imprisonment |
+----------------------------------------------------------------------------------+Supporting Context & Metrics: Iran’s Global Proxy Terror Network
Quantitative Surge in Transnational Plots
Data compiled by foreign policy analysts reveals a sharp escalation in state-sponsored external operations following periods of domestic unrest in Iran.
According to tracking data maintained by Matthew Levitt at the Washington Institute for Near East Policy, Iranian-backed plots targeting foreign targets, dissidents, and journalists have surged dramatically over the past five years.
NUMBER OF IRANIAN EXTERNAL PLOTS TRACED GLOBALLY
=================================================
1979 - 2021 (42-Year Period) : ~110 Documented Plots
2019 - 2024 (5-Year Period) : 200+ Documented Plots
=================================================Experts attribute this surge to a combination of internal vulnerabilities and external setbacks, including:
- The 2020 US drone strike that killed Quds Force Commander Qassem Soleimani.
- Widespread domestic protests that repeatedly threatened regime stability.
- Military pressure on Iranian proxy networks across the Middle East.
The Criminal Ecosystem: Mobsters, Bikers, and Teenagers
To execute operations without attracting direct diplomatic retaliation, Iranian intelligence agencies rely heavily on criminal proxies, outsourcing violent contracts across multiple jurisdictions:
+------------------------------------------------------------------------------------+
| OPERATIONAL OUTSOURCING MATRIX |
+------------------------------------------------------------------------------------+
| Target Location | Targeted Individual / Institution | Criminal Proxy Enlisted |
+-----------------+-----------------------------------+------------------------------+
| Maryland, USA | Iranian Political Exiles | Naji Sharifi Zindashti Syndicate|
| Brooklyn, USA | Journalist Masih Alinejad | Eastern European Mobsters / |
| | | Azerbaijani Gunmen |
| Bochum, Germany | Local Jewish Synagogue | Hells Angels Outlaw Club |
| Haarlem, NLD | Siamak Tadayon Tahmasbi (Dissident)| Franco-Tunisian Hitmen |
| Stockholm, SWE | Israeli Diplomatic Missions | Foxtrot Gang / Local Teens |
| Paris, France | Commercial US Infrastructure | Recruited Teens via Snapchat |
+------------------------------------------------------------------------------------+Key Tactical Innovations:
- The "Cutout of a Cutout" Model: Swedish security services have documented how Iran uses international gang leaders, such as Rawa Majid ("the Kurdish Fox") of the Foxtrot Network, to contract local juveniles. Minors are recruited through Telegram and Snapchat to conduct grenade attacks and shootings against diplomatic and civilian targets.
- Minimalist Handler Briefings: Handlers rarely communicate political ideologies to proxies. Operations are frequently presented as mundane criminal enforcement—such as collecting debts or punishing romantic rivals—masking the ultimate state sponsor.
[IRGC / Ministry of Intelligence]
|
v
[Criminal Kingpin]
(e.g., Zindashti / Rawa Majid)
|
v
[Local Gang Leader]
|
v
[Unwitting / Teen Proxy]
(Recruited via Snapchat / Telegram)Siege Mentality at Iran International
The campaign has forced independent media organizations into unprecedented security postures. At Iran International’s secure headquarters in West London, operations resemble those of a high-security military facility:
+----------------------------------------------------------------------------------+
| IRAN INTERNATIONAL: FACILITY PROFILE |
+----------------------------------------------------------------------------------+
| Global Staff Count | ~700 Employees across multiple global bureaus. |
| Ownership & Funding | Volant Media (Controlled by Saudi businessman |
| | Adel Abdulkarim Alabdulkarim). Dec 2023 financial |
| | restructuring included an $870M debt-for-equity swap. |
| Physical Defense | Perimeter blast walls, vehicle anti-ram barriers, double |
| | air-lock security vaults, armed guard escorts. |
| Cyber Defense | Multi-factor authentication, deepfake-voice verification |
| | protocols, anti-phishing defense software. |
+----------------------------------------------------------------------------------+Despite state harassment—including asset seizures inside Iran, threats against home-country relatives, and a April 2024 arson attempt against the studio entrance—the network continues to broadcast to millions of households via satellite dishes that bypass domestic firewall restrictions.
Official Statements & Analytical Perspectives
On Strategic Intent and Deniability
Colin Clarke, Executive Director at the Soufan Center:
"Hired criminals are cheap, and they know how to blend in. Iran doesn’t seem to care if these guys get caught or can’t get the job done. Sometimes terrorism isn’t about body counts. It’s about who is watching."Matthew Levitt, Senior Fellow at the Washington Institute for Near East Policy:
"The more setbacks Iran experiences at home and in the region, the more attractive these fairly cost-free operations become. Unless Western governments find a real way to increase the costs, the regime will continue to get away with kidnapping, conducting surveillance, and ultimately trying to murder people on their soil."
On Law Enforcement and Legal Challenges
Sir John Jenkins, Former UK Ambassador to Saudi Arabia:
"Torching Jewish ambulances, or even stabbing a journalist in London—these incidents don’t quite rise to the same level as blowing up a bus or an embassy. Investigating a single case in Europe or Britain’s legal system can take months or even years in courts. In the meantime, Iranian operatives have evolved their playbook."Phillip Smyth, Counter-terrorism Analyst:
"Criminals can obtain false documents, cross borders, rent safe houses, arrange cars, move money, and disappear. Handlers do not need to explain the ideology behind an operation… The pitch can be remarkably simple: ‘I’m offering you cash. Here is the lie as the cover.’"
On the Human Impact within the Diaspora
Sima Sabet, Independent Journalist and Exile:
"I feel like a fugitive in a town I have called home for more than two decades… Anyone who is against them is against God. We are infidels. It is acceptable to eliminate us."Pouria Zeraati, Host of The Last Word:
"I felt as though I was my own detective, prophesying my assassination… I am not concerned with how many years these guys get locked away—they were disposable agents. What mattered was establishing who sent them."
Future Outlook: Policy Dilemmas and Transnational Threats
The evolution of state-sponsored proxy violence leaves Western intelligence and counter-terrorism agencies facing a complex policy landscape. Because these operations fall just below the threshold of conventional military acts of war, democratic nations often struggle to formulate effective countermeasures.
+-----------------------------------------------------------------------------------+
| WESTERN POLICY RESPONSES & COUNTERMEASURES |
+-----------------------------------------------------------------------------------+
| Policy Vector | Action Implemented / Under Consideration |
+-----------------------+-----------------------------------------------------------+
| Legislative Listing | Formal designation of the IRGC as a proscribed |
| | Terrorist Organization under national security laws. |
| Financial Sanctions | Targeted sanctions against IRGC Unit 840, proxy fronts |
| | (e.g., Hemroc Ltd.), and associated criminal brokers. |
| Diplomatic Measures | Expulsion of undercover intelligence officers operating |
| | under diplomatic cover within European embassies. |
| Judicial Protections | Expanded protective custody, safehouse networks, and |
| | threat-monitoring protocols for exile journalists. |
+-----------------------------------------------------------------------------------+Key Trends to Monitor:
- Digital Recruitment Platforms: The migration of handler communications to encrypted channels and public social media platforms (Telegram, Snapchat) will continue to complicate attribution and lower the entry bar for amateur proxies.
- Jurisdictional Arbitrage: Assailants will increasingly exploit open-border zones (such as the Schengen Area) to launch cross-border strikes before retreating to non-extradition countries.
- Diaspora Displacement: High-risk figures are increasingly pushed out of traditional European havens toward alternative jurisdictions. Following his recovery, Pouria Zeraati relocated his operations to Israel, concluding that European capitals could no longer guarantee his safety.
Though judicial outcomes like the convictions at the Old Bailey mark small victories for law enforcement, experts emphasize that individual prosecutions rarely disrupt the primary threat actors in Tehran. Until Western nations establish direct strategic costs for state sponsors of transnational crime, the diaspora media community will remain on the frontlines of an asymmetrical global confrontation.
Comments
Facebook App ID not configured. Please add it in the Customizer.