How Iran is outsourcing terror plots against Jews
Experts say Iran-linked actors rely on online recruits and cyberattacks to target Jewish communities in Europe and the U.S.
Local residents walk past a cordoned area where a fire broke out at a supermarket in the Golders Green neighbourhood in north London on May 27, 2026. London’s firefighting service said on May 27 it was responding to a fire in Golders Green, a north London neighbourhood home to a large Jewish community targeted in recent months by a number of arson attacks. Photo by Toby Shepheard / AFP via Getty Images
By Simone Saidmehr June 5, 2026
The prosecution of an Iraqi national in connection with thwarted alleged terror plots in the U.S. and Europe has put the behind-the-scenes role of Iran in the spotlight — part of what security experts say is a growing and hard-to-trace threat.
Mohammad Baqer Saad Dawood Al-Saadi, a 32-year-old Iraqi national accused of ties to an Iran-backed militia, pleaded not guilty in Manhattan federal court this week to charges linking him to a series of attacks and alleged terror plots targeting American interests and Jewish communities in Europe and the United States.
Prosecutors allege Al-Saadi was connected to attacks, including the stabbing of two Jewish men in London’s heavily Jewish Golders Green neighborhood and an arson attack on a synagogue in North Macedonia. They also accuse him of attempting to recruit individuals online to firebomb synagogues in New York, Los Angeles and Scottsdale, Arizona.
He also reportedly planned to attack Ivanka Trump, who is both the president’s daughter and an Orthodox Jew — making her a “double target,” in the words of Oren Segal, vice president at the Center on Extremism at the Anti-Defamation League.
Iranian attacks on Jewish and Israeli institutions abroad are not new. Since the 1979 Islamic Revolution, Iran and its proxies have targeted diplomats, Jews, Israelis, political dissidents and others perceived as aligned with the West.
Matthew Levitt, director of the Counterterrorism and Intelligence Program at the Washington Institute for Near East Policy, maintains a detailed database of such attacks. He told the Forward that since the current war began, such plots have significantly increased.
The Al-Saadi case is a prime example of what Levitt calls Iran’s “gig economy” model of terrorism. Rather than dispatching trained operatives directly from Iran, Iranian-linked actors and proxy groups are recruiting individuals online who live in the country they wish to target. Some are not even aware they are attacking on behalf of Iran or its proxies.
In court filings, prosecutors allege that Al-Saadi, who prosecutors link to the terror organization Kata’ib Hezbollah and Iran’s Islamic Revolutionary Guard Corps, sent maps and photographs of a prominent Manhattan synagogue and other Jewish institutions to an undercover agent he was attempting to recruit to firebomb them. He allegedly offered the agent $10,000 in cryptocurrency in exchange for carrying out the plot, and discussed whether the recruit should “set the place on fire” or use an improvised explosive device.
Iranian-linked operatives, who are either part of Iran’s security apparatus or within its network of terror proxies, reach out to potential recruits on encrypted platforms like Telegram.
According to Levitt, the operatives are ordered by “very senior” elements of the Iranian regime to find recruits. “It stretches the limits of credulity to think that plots like this in the United States could be done without very senior top-down instruction,” Levitt said. “These are not rogue actors.”
Those they manage to recruit online are often financially motivated, agreeing to carry out attacks like vandalism, surveillance, or assaults in exchange for cryptocurrency payments. Others appear driven by ideology or online radicalization. Over the years, Iran’s recruits have included teenagers as young as 13.
“These are inexpensive plots,” said Levitt. “It requires just a few people to sit at a computer and try to recruit people and direct people.”
For Iran, this method is particularly strategic amid wartime. “Iran can’t go toe to toe with the U.S. or Israeli militaries, but it can engage in these asymmetric plots to show that they can still reach out and touch us to increase the cost of continuing to prosecute the war and to make people feel afraid,” said Levitt.
By relying on online recruits and loosely connected operatives, Levitt says Iranian-linked actors can obscure their involvement and maintain reasonable deniability. The calculation, he explained, is that authorities will be satisfied with arresting and prosecuting the individual carrying out the attack, rather than blaming Iran. This allows Iran to limit the risk of direct military escalation with the United States while continuing to conduct operations against it.
The Online Battlefield
According to Segal, Iranian influence increasingly permeates online.
“The threat to Jewish communities right now is multidimensional — Iranian-linked plots, cyberattacks, online propaganda,” he said. “They’re all converging at once, making it one of the more complex threat environments for the Jewish community in a long time.”
For years, Iranian state media outlets such as Press TV have targeted Western audiences with antisemitic content, including Holocaust denial, claims that Zionists control world events and other extremist narratives. A 2023 report by the ADL and the Center for Countering Digital Hate found that Press TV receives roughly one million monthly visits, with more than half of its traffic coming from Western countries.
Segal said Iranian-linked propaganda networks also increasingly operate in online spaces that overlap with broader activist communities. One such example is Resistance News Network, a Telegram channel with over 150,000 subscribers frequented by members of pro-Palestinian activist groups like Students for Justice in Palestine. The channel is filled with official Hamas, Hezbollah, and Houthi propaganda that is then reshared by American activists on mainstream social media accounts.
“What that does is enable the exchange of ideas, of propaganda, and of narrative that we then see show up at actual events on the ground,” he said.
Segal argues that exposure to such propaganda can make recruitment efforts easier.
“Our concerns are not only from somebody who may have been placed here or somewhere in Europe,” said Segal, “but from individuals who are animated by the propaganda they ingest every single day.”
Levitt agreed, stating that rising antisemitic and anti-Israel sentiment since the outbreak of the Gaza war has created a larger pool of individuals who may view attacks on Jewish or Zionist targets as justified.
“A lot of people are going to be much more willing to do something … especially if it’s not actually killing someone, but fire bombing something and/or targeting property that has symbolic value,” he said.
But the threat is not limited to physical violence.
Since the war began, Segal said Iranian-linked cyberattacks have “gone into overdrive.”
He says Jewish organizations and media outlets have faced hacking attempts on their websites, while Jewish individuals have had their identities stolen, with personal information being exposed online in mass doxxing campaigns.
Many such attacks are conducted by Iranian hacking collectives. One of the most notorious among them is Iranian hacker group Handala Hackers, which has conducted several attacks against Jews, Israelis and Americans. The FBI reported that in March, the group claimed to have stolen 851 gigabytes of confidential data from Sanzer Hasidic Jewish community members, which the hackers described as “documents of financial cooperation, witchcraft ceremonies, and secret correspondences with Netanyahu …” They added, “We warn the leaders and members of the Sanzer Hasidic community: No place is safe for you. Betrayal of the oppressed leads to nothing but disgrace and shame. Expect more documents to be revealed.”
Despite the growing number of plots, experts say the relative lack of successful attacks inside the United States reflects the effectiveness of American counterterrorism efforts.
Still, Jewish communities across the United States are investing heavily in security upgrades. Asher Lopatin, director of community relations at the Jewish Federation of Greater Ann Arbor, said synagogues in Michigan have increased security following a March attack on Temple Israel in West Bloomfield by a Hezbollah-linked man. Communities are installing bollards, expanding surveillance systems, and hiring additional guards.
“People are definitely doubling up on security,” Lopatin said. “Everyone is traumatized.”
Levitt says that even after the war concludes, he does not expect the plots targeting American interests and Jews to cease.
“I do not think that when the war ends, these necessarily stop,” Levitt said. “The pace may change, but Iran has a distinct interest in exacting revenge for all the damage that was done to it.”
I’m personally matching all gifts to the Forward, up to $36,000. Can I match your gift now?
Hello, fellow Forward reader! I’m Joel Brown, a Forward reader and supporter for more than 15 years, and currently the chair of the board of directors.
I’m an avid Forward reader because it ticks so many of my essential boxes: excellent journalism, Jewish focus and diverse viewpoints. In today’s political climate, what I most appreciate is the Forward’s independence — made possible by the generosity of its membership.
The Forward is committed to bringing you unbiased, nuanced Jewish news. From my position as board chair, I see an exciting future as we expand our position as the definitive independent voice of contemporary American Judaism.
— Joel Brown, Forward board chair
Support our mission to tell the Jewish story fully and fairly.
