From Tehran to Europe: Terrorism Risks After the Killing of Iran’s Ayatollah

The morning of 28 February 2026, the United States (US) and Israel launched a military campaign against strategic targets in Iran. As of 8 March 2026, missiles and drones continue flying within Iran and across the region as the US and Israel continue their campaign inside Iran, Iran targets US and Israeli personnel and assets in several Middle East countries, Israel continues its campaign in Lebanon targeting Iran’s proxy Hezbollah, and multiple violent non-state actors and terrorist groups launch attacks in support of Iran. The opening salvage of this military campaign was remarkably different from what we saw in the June 2025 12-day war between Israel and Iran because this time, it included a successful decapitation strike targeting Iran’s Supreme Leader, Ayatollah Khamenei. While all military operations and interventions create international security concerns and risks, assassinating the Ayatollah raises the stakes because it introduces uncertainty about potential regime change and political instability in a volatile region of the world. Learning from previous Western military interventions in Afghanistan and Iraq, it is clear that political instability and regime transition can result in a heightened terrorist threat. In the case of Iran, because of its history of state-sponsored and state-led terrorism, the symbolic role of the Ayatollah and his martyrdom, and geographic location, the terrorism and counter-terrorism implications of political instability are noteworthy both in the region and around the world. 

This analysis first describes the anticipated “routine” terrorism and counter-terrorism risks associated with interstate conflict with Iran, focusing on Iran as a state sponsor of terrorism and a perpetrator of state-led terrorism. Then follows a discussion on the lurking risks that could develop, especially if there is a prolonged military intervention. The analysis concludes with an emphasis that great power competition and changes in international relations or security should not push counter-terrorism to the sidelines. These are interlinked security risks and need to be recognised as such. 

Anticipated “Routine” Terrorism & Counter-Terrorism Threats

Iran has long maintained – funded, trained, and coordinated – a network of violent non-state actors in the Middle East. High-level leaders of the Islamic Revolutionary Guard Corps (IRGC), a designated terrorist group, routinely travelled to Syria and Lebanon, among other countries, to embed with and train terrorist groups like Hezbollah and Hamas. But since the 7 October 2023, Hamas terrorist attacks against Israel and the ensuing war, Hamas and Hezbollah have been severely weakened. But the threat persists, as demonstrated by Hezbollah’s attacks against Israel on 2 March 2026 in retribution for the Ayatollah’s assassination. And with Ahmed Hussein al-Sharaa’s victory in Syria and the overthrow of Bashir Assad, Iran lost an important client state that had helped funnel weapons, finances, and other resources to Iran’s regional terrorist network. 

Although these parts of Iran’s proxy network are now strained, three components of the axis of resistance – the Houthis in Yemen, the Popular Mobilisation Forces (PMF) in Iraq, and the Islamic Resistance in Iraq (IRI) – remain strong. All three are critical cogs for maintaining Iran’s state-sponsored terrorist threat in the region. 

One of Iran’s immediate responses to the recent military strikes was threatening all shipping in the Hormuz Straight because 20 percent of the world’s oil barrels travel through it. In tandem, the Houthis announced a renewed campaign against shipping in the Red Sea, which had ended following the October 2025 Israel-Hamas ceasefire. Depending on the course forward in Iran, the regime could mobilise the Houthis to also rekindle their fight against the Saudi Arabian-supported Presidential Leadership Council and UAE-backed Southern Transitional Council governments. 

In Iraq, the PMF is a group of Shia militias organised within the Iraqi Armed Forces but have pledged allegiance to the Ayatollah, and many remain steadfast in sidestepping their official national chain of command and submitting to the Ayatollah’s wishes. This structure and relationship mean that if called upon by Iran, the PMF could escalate their violence and brutality against civilians, particularly minority groups in Iraq. It also keeps the door open for the militias to rebuke their officially mandated responsibilities and return to operating as resistance groups fighting against the Iraqi government. While not directly tied to the PMF, the signs of possible trouble and Iranian interference and influence over Iraq’s national security are already laid bare to see. The day after the Ayatollah’s assassination, hundreds protested in Baghdad’s Green Zone with various PMF militia flags waved.

There is another coalition of pro-Iranian militias in Iraq, the IRI, which operates outside the Iraqi Armed Forces. IRI members conduct attacks against the US, Israel, and other foreign interests in the region. If PMF militias defect, the IRI provides a stable alternative network to join. And the IRI has been actively retaliating by perpetrating and claiming attacks against US assets and soldiers in Iraq, starting the day after the Ayatollah’s assassination.

The role of these Iranian-backed militias takes particular significance in light of the recent transfer of thousands of Islamic State (ISIS) detainees, including European nationals, from Syria to Iraq. While Shia militias are enemies of ISIS, they could destabilise Iraqi security structures, and therefore Iraq’s capacity to safely guard ISIS fighters and detainees. More broadly, they could instigate and accelerate ethnic and religious tensions, triggering localised, and potentially national, violence, conflict, and instability that ultimately helps ISIS rebuild in Iraq. 

Europe and the US could be even more directly affected. Over the past decade, data collected by Matthew Levitt shows that Iran increased its collaboration with and use of criminal networks in Western countries to commit violence and target journalists, politicians, Jewish communities, and Iranian and Kurdish dissidents. For example, in the 2024 annual report, the Dutch intelligence service AIVD highlighted Iran’s support, and likely coordination, of the attempted murder of an Iranian activist by suspected members of criminal networks that also attempted to assassinate the Spanish politician Alejo Vidal-Quadras in 2023. Court records document direct connections between criminals travelling to and from Iran and then coordinating political violence in Europe. In Germany, during hearings in a Dusseldorf state court, the prosecution established that Iran sponsored a former Hells Angels member, including travel to Iran, to plan and recruit a perpetrator for an attack against a synagogue in Bochum. And in 2025, two members of the Russian organised crime network in New York City were sentenced to 25 years in prison for a murder-for-hire plot coordinated by Iran against Masih Alinejad, an Iranian-American journalist and women’s rights activist. Relying on organised crime and criminal networks provides both a layer of plausible deniability for Iran and leverages a client relationship where individual acts of violence can be contracted without long-term financial commitments needed to sustain terrorist networks abroad. These aspects allow Iran to quickly and efficiently hire criminals and thugs living outside the direct conflict zone to exact retribution and punishment.

In many countries, some Iranian communities have spoken out and led protests against the current regime and celebrated the Ayatollah’s assassination. If Iran thinks protesters’ voices are influencing their enemies’ military campaigns or willingness to negotiate, leading dissidents and activists may find themselves in the crosshairs of Iran’s violence-for-hire criminal networks. And Iran’s previous weaponisation of criminal networks has targeted Jewish communities and synagogues, particularly in Europe, considering them legitimate extensions and representations of Israel. Increased anti-Semitism and violence against Jewish communities in Europe and North America, and the divisive discourse and securitisation fallout of the Israel-Gaza war, provide a combustible context that Iran could try to ignite. Criminal networks could be hired to fan these flames by attacking Jewish communities and symbols.  

Iran also directly engages in state-led terrorism with agents deployed around the world that can be activated when necessary. Some of these agents act as interlocutors with organised crime, gangs, and terrorists in Europe. For example, Assadollah Assadi, an Iranian diplomat in Austria, was sentenced to 20 years in prison in Belgium for supplying bomb-making material intended for a mass casualty attack targeting a National Council of Resistance of Iran (NCRI) meeting in Paris. Although this approach of state-led terrorism is less often the plan of attack compared to state-sponsored terrorism, like mobilising its terrorist network, recruiting agents to commit violence or hiring criminal networks still presents a threat to national security. Agents could have been placed in embassies years ago, awaiting activation and orders. As Israel and the US petition their friends and allies to use their military bases or support the campaign, Iranian agents embedded in these countries could try to deter, or punish, collaboration through sabotage and terrorist acts. Particularly if the possibility of regime change increases, these agents, and other Iranian government officials throughout the world, may feel like cornered animals with nothing to lose and commit violence as a last resort in support of their regime and fear of their own future under a new government. 

Another risk that is challenging but important to project, is that the Ayatollah’s assassination and conflict in Iran could inspire individuals to seek retribution through terrorist attacks. It is important to recognise that the threat does not necessarily come directly from the Iranian diaspora, which in many countries is likely to be more anti-regime than pro-regime, but because of the Ayatollah’s symbolic role in many extremist Shia movements and the martyrdom narrative surrounding his assassination, Shia extremists could be motivated to act. The Sunday, 1 March 2026, shooting in Austin, Texas, where the perpetrator wore a “Property of Allah” hoodie and t-shirt stamped with the Iranian flag, exemplifies this threat. Investigators are treating it as a terrorist attack and exploring potential connections between the US strikes on Iran, the Ayatollah’s assassination, and the shooting. While it is only one case, it may be the tip of the spear, and other radicalised individuals may commit terrorist attacks in support of Iran or to avenge the martyred Ayatollah Khamenei. After-action reports and investigations can shed light on whether perpetrators belong to pre-existing international cells that are activated by Iran, its terrorist network, or individuals inspired by political events and the military campaign.

Because these networks, tactics, tools, and procedures have historical routes and have repeatedly been deployed, it is relatively straightforward to anticipate these potential threats, which could be immediate responses ordered by Tehran. It is more challenging to project mid- to longer-term threats. However, it is particularly interesting to look at how major terrorist organisations, mainly al-Qaeda and Islamic State Khorasan Province (ISKP), may react and adapt to potential political instability in Iran.  

Mid- to Long-Term Terrorism & Counter-Terrorism Threats

Al-Qaeda operates from several safe havens around the world, one of which is Iran. And, at times, Iran directly supports al-Qaeda with weapons and funding. But their religious ideological differences, a Shia Iran and a Sunni al-Qaeda, limit direct commitment to each other’s political objectives. The core of their relationship is centred on disrupting US interests in the region. And is best summarised as a “marriage of convenience” allowing al-Qaeda to facilitate financial transactions and the flow of personnel and fighters throughout the country in return for (mostly) limited terrorism inside Iran or against Iranian targets. The al-Qaeda-affiliated Cyber Jihad Movement’s recent call for cyber jihadis to support Iran and pro-Iranian hackers against Israel and the US demonstrates al-Qaeda’s commitment to the relationship. If the “marriage of convenience” begins deteriorating, either because of political instability or regime transition, al-Qaeda’s existing network provides the necessary seeds to grow a strong base of operations to perpetrate terrorism inside Iran, target and disrupt foreign interests in the region, and coordinate international terrorist attacks. If a more hardline Ayatollah is appointed and consolidates his authority, this also provides al-Qaeda with opportunities. While the ideological differences would still prevent close collaboration toward political goals, a more hardline regime could be open to weaponising al-Qaeda as part of its terrorist network and potentially provide the terrorist group with materials for dirty bombs. This may be a weapon of last resort for any Iranian regime, but the potential should be considered.

ISKP likely poses a more near-term and direct threat to European security if Iran falls into political instability and chaos. Unlike al-Qaeda, ISKP views Iran as an enemy apostle state and a legitimate target and has committed multiple terrorist attacks against and inside Iran. ISKP, therefore, does not benefit from a similar safe haven status, but nevertheless continues to operate cells and networks inside Iran. Geography plays a critical role in this dynamic. While parts of Iran are in the historical Khorasan (including three official Khorasan provinces in Iran), it is the central location of Iran in ISKP’s “Turkey Pipeline” that is important. The “Turkey Pipeline” is used for smuggling resources and fighters to ISKP’s bases in Afghanistan and sometimes back to Turkey to conduct terrorist attacks there or abroad. The credibility of this threat is demonstrated by the increasing infiltration and embeddedness of Islamic State and ISKP cells in Turkey. While ISKP is predominantly focused on fighting the Taliban in Afghanistan and committing terrorist attacks in central Asia, political instability in Iran could significantly strengthen the group’s smuggling and foreign fighter networks and capabilities, which pose a direct threat to Europe. ISKP has already demonstrated its ability to commit international attacks and reach targets far outside the Khorasan; for example, the Crocus City Hall attack and multiple arrests and foiled plots across Europe. Inside Iran, if signs of prolonged political instability surface, ISKP could try provoking or escalating conflict and sectarian violence. Doing so could create opportunities to establish a stronger and sustained territorial presence that provides an ISKP-controlled buffer zone along Afghanistan’s eastern flank. In this scenario, a stronger ISKP likely also means intensified conflict with the Taliban in Afghanistan, which risks widening and spiralling political instability in the region.

Terrorism, Counter-Terrorism, Great Power Competition Nexus

A good “day-after” plan ought to have considered these lurking threats. While Iran’s retaliation, so far, includes several of the anticipated threats, it is likely to take longer and perhaps requires a prolonged military intervention and political instability to trigger these lurking threats. But, with heightened great power competition, governments and security agencies increasingly shifted resources, attention, and analyses to inter-state conflicts, defence, and deterrence. This often came at a cost to other threat vectors because resources – both financing and labour – are finite and reallocation was deemed necessary. Terrorism and counter-terrorism, in particular, were often pushed down the list of pressing national security concerns, especially in Western Europe and North America, because the increase in great power competition was widely accompanied by a decline in the number of foreign terrorist plots and attacks targeting these countries. But this is not a zero-sum trade-off. When funding, staffing, and attention decline, it risks an increased threat because of decreased anticipation and response capabilities. Great power competition shapes, and at times defines, terrorism trends and threats and the immediacy of counter-terrorism defence, and potential offence. Depending on the path forward in Iran, the increased risk of terrorism, in Iran, the region, Europe, and countries supporting or aligned with the US and Israel could bring the chickens home to roost because increased attention to great power competition often came at the cost of decreased attention to terrorism and counter-terrorism.

Funded by the European Union (ERC, TERGAP, 101116436). Views and opinions expressed are, however, those of the author(s) only and do not necessarily reflect those of the European Union or the European Research Council. Neither the European Union nor the granting authority can be held responsible for them.

This article represents the views of the author(s) solely. ICCT is an independent foundation, and takes no institutional positions on matters of policy unless clearly stated otherwise.

Photo credit: Tomas Ragina/ Shutterstock