In the months before his attackers tracked him down, the exiled Iranian journalist had been moved in and out of safe houses by London’s Metropolitan Police, given a secret way to signal rescue units and had monitoring devices installed in his home.
British authorities had done even more to protect Iran International, the London-based satellite news channel that airs the weekly program of the journalist, Pouria Zeraati, and has built an audience of millions in Iran despite being outlawed by the Islamic republic.
Iran’s alleged reliance on criminals rather than covert operatives underscored an alarming evolution in tactics by a nation that US and Western security officials consider one of the world’s most determined and dangerous practitioners of “transnational repression,” a term for governments’ use of violence and intimidation in others’ sovereign territory to silence dissidents, journalists and others deemed disloyal.[1]
Senior security officials said that the use of criminal proxies by governments has compounded the difficulty of protecting those who have sought refuge in the United States, Europe and elsewhere. Security services formerly focused on tracking operatives from Russia’s GRU spy agency or Iran’s Islamic Revolutionary Guard Corps (IRGC) now confront plots handed off, often through encrypted channels, to criminal networks deeply embedded in Western society.
In recent years, Iran has outsourced lethal operations and abductions to Hells Angels biker gangs, a notorious Russian mob network known as “Thieves in Law,” a heroin distribution syndicate led by an Iranian narco-trafficker and violent criminal groups from Scandinavia to South America.
This story reveals new details about how Iran has cultivated and exploited connections to criminal networks that are behind a recent wave of violent plots secretly orchestrated by elite units in the IRGC and Iran’s Ministry of Intelligence (MOIS). It is based on interviews with senior officials in more than a dozen countries, hundreds of pages of criminal court records in the United States and Europe, as well as additional investigative documents obtained by The Washington Post from security services.
With hit men it has hired in the criminal underworld, Iran has commissioned plots against a former Iranian military officer living under an assumed identity in Maryland, an exiled Iranian American journalist in Brooklyn, a women’s rights activist in Switzerland, LGBTQ+ activists in Germany and at least five journalists at Iran International, as well as dissidents and regime critics in a half dozen other countries, according to interviews and records.
Other nations have begun to embrace this strategy. India’s security services enlisted criminal groups to kill a Sikh activist in Canada last year and target another in New York, according to US and Canadian officials. Russia, which has traditionally relied on its own agents for lethal operations, turned last year to mob elements in Spain to kill a military helicopter pilot who had defected to Ukraine and then resettled in the Mediterranean.
Iran’s turn to criminal proxies has in part been driven by necessity, officials said, reflecting the intense scrutiny that Iran’s own operatives face from Western governments. The attack on Zeraati avoided these Iran-focused defenses. “We’re not dealing with the usual suspects,” said Matt Jukes, the head of counterterrorism policing in the United Kingdom and assistant commissioner for special operations with Scotland Yard. He acknowledged that Zeraati’s assailants remain at large more than five months after his stabbing. They have been identified and their travels traced to countries in Eastern Europe but have so far not been detained. Officials said the suspects remain in Eastern Europe and that other security services are cooperating with British authorities, but they declined to explain why the suspects have not been taken into custody. “What we’ve got is a hostile state actor that sees the battlefield as being without border and individuals in London every bit as legitimate as targets as if [they were] in Iran,” said Jukes. Along with Britain’s domestic spy agency, MI5, the Metropolitan Police have tracked more than 16 plots from the Islamic republic over the past two years, according to British intelligence and security officials, many of whom spoke on the condition of anonymity to discuss sensitive and ongoing investigations. The United States has faced a wave of similar threats, including several that have been detailed in criminal indictments connecting biker gangs in Canada and mob elements in Eastern Europe to planned assassinations commissioned by Iran.
Matthew G. Olsen, who heads the national security division at the US Justice Department, said that “Iran is clearly at the top of the list” of states that year after year seek to kill or abduct dissidents and journalists outside their borders. Other nations, particularly China, seek to intimidate or repress diaspora populations, Olsen said, but Iran is consistently “focused on actions at the extreme end of [transnational repression] because of their lethal targeting.”
Iran dismissed the accusations as Western disinformation. “The Islamic Republic of Iran harbors neither the intent nor the plan to engage in assassination or abduction operations, whether in the West or any other country,” Iran’s mission to the United Nations said in a statement. “These fabrications are concoctions of the Zionist regime, the Albania-based Mujahedin-e Khalq terrorist cult, and certain Western intelligence services, including those of the United States, to divert attention from the atrocities committed by the Israeli regime.”
A surge in attacks - Iran’s overseas operations have intensified in response to a period of political upheaval driven by mass protests over economic conditions and the regime’s treatment of women. The security services in Tehran are targeting those outside the country whom they accuse of stoking these internal divisions, Western officials and analysts said.
Amid worries that the conflict in Gaza might break out into a regional war, Tehran has also been linked to plots against US and Israeli officials and members of Jewish communities in France and Germany.
The US Justice Department filed charges last month against a Pakistani man with ties to Iran who was accused of seeking to hire a hit man to assassinate political figures in the United States, possibly including former president Donald Trump. It was the latest in a series of plots against members of his administration, including former secretary of state Mike Pompeo and former national security adviser John Bolton, in response to a 2020 US drone strike in Iraq that killed IRGC leader Qasem Soleimani.
Security officials and experts said the pace of operations emanating from Iran is unprecedented. Data published by the Washington Institute in August listed 88 assassination, abduction and other violent plots linked to Iran over the past five years, exceeding the total for the preceding four decades following the 1979 revolution. At least 14 of those recent cases involved criminal organizations. “We’re seeing a major escalation in lethal plotting from a government that has used this tactic from the outset,” said Matthew Levitt, a counterterrorism expert at the Washington Institute. The results have been mixed.
For every plot that has succeeded, others have failed, often because of blunders committed by those hired. Iran appears to accept the downsides of the outsourcing model because of offsetting advantages. These include making it more difficult for authorities to attribute attacks to Tehran, an abundance of criminals willing to commit violence for relatively modest sums of money and a negligible price of failure. Rather than putting Iran’s own agents at risk, a US intelligence analyst said, “two guys they barely know will spend 20 years in jail.”
Zeraati, who is 36, had faced threats since starting his program in 2022 at Iran International, a Saudi-funded satellite and online news platform that bypasses Iran’s censors and beams news and commentary to millions of viewers. In November 2022, Zeraati’s wife, a real estate agent, was approached by two men on a motorcycle outside a London health club. “We know where you live,” one said, according to Zeraati. “We will kill your husband.” Zeraati was one of five Iranian journalists whose pictures appeared on “Wanted, Dead or Alive” posters hung from signposts in Iran and circulated widely on social media outlets tied to the government.
A wanted poster was distributed by Iranian state-backed media that shows photos of Iranian journalists including Zeraati, who was stabbed in London in March. Yet the stabbing took place at a time when the threat level facing Iran International was perceived to have declined. The channel had returned from its Washington relocation to new London studios ringed by blast walls, guard stations and surveillance cameras. After multiple stays at safe houses, Zeraati had returned to his residence, a flat in a four-story apartment building so close to the famed Wimbledon tennis complex that you can hear the thwack of balls being struck on practice courts. The assailants appear to have taken advantage of security vulnerabilities. His home address can be found in online property records. His broadcast schedule, one weekly show airing Friday nights, pointed to a predictable commute pattern.
As Zeraati crossed the street to his car around 3 pm to head to work, he caught sight of a disheveled man approaching him. “Brother, can I have three pounds change,” the man said, Zeraati recalled in an interview. While Zeraati continued toward his car, a second man emerged from a driveway obscured by foliage. The second seized Zeraati’s arms while the first, smiling broadly, plunged a blade into his leg repeatedly. The decision to stab his thigh rather than his heart or other vital organs led police to believe the attack was intended as a warning.
The assailants then raced up the street to meet an accomplice with a car. Zeraati’s first thought was that he had been mugged. But as he reached for his phone to call an ambulance, he realized that the attackers had not taken any of his belongings, including a wallet, a watch and a Montblanc pen. “At that moment it clicked,” Zeraati said. “It had been related to my job.”
If the stabbing was meant to silence Zeraati and sow fear among the regime’s Western critics, it was only partially successful. Zeraati returned to the airwaves after a brief hospital stay. “I wanted to send a message that the flow of information in the 21st century can’t be stopped,” he said. Other journalists, dissidents and regime critics acknowledge that they remain deeply shaken. “It sent a chill through my spine,” said Alireza Nader, an independent Iran analyst based in Washington. “I look over my shoulder now,” he said. “Everybody who is active against the regime, speaks publicly against the regime, felt that attack.”
British officials have not publicly accused Iran of responsibility. Security officials said they see no alternative explanation but are still gathering evidence. Iranian officials have said the country was not involved in the stabbing. “We deny any link to this story of this so-called journalist,” the country’s ambassador to the United Kingdom said in a post on X the day after the attack.
Enlisting Hells Angels - Iran has outsourced assassinations and abductions to at least five criminal syndicates, officials said. At the center of this web is an alleged heroin trafficking kingpin based in Iran, Naji Sharifi Zindashti. US criminal charges were issued public earlier this year outline an alleged scheme in which Zindashti negotiated a $350,000 contract with two Hells Angels members in Canada to kill an Iranian defector and his wife living under false identities in Maryland. In exchanges over encrypted texts, the would-be assassins discussed their client’s insistence that the slaying be symbolically vicious. One assured the other that he would “make sure I hit this guy in the head with ATLEAST half the clip,” according to the US indictment, adding, “we gotta erase his head from his torso.” The name of the targeted defector has not been disclosed, but US officials said the individual had served as an officer in the IRGC, a powerful wing of Iran’s military created after the 1979 revolution, and become an informant for the CIA. The incongruous partnership between an Islamic theocracy and a notorious biker gang was driven in part by necessity, officials said, given the resources US security agencies devote to preventing Iran from deploying operatives to the United States.
The Hells Angels, however, has chapters across the country as well as a powerful grip on narcotics trafficking in Canadian provinces, officials said. And there were previous connections between Iran and Hells Angels. In another plot, Iran used a German member of the gang, Ramin Yektaparast, who had fled to Tehran to escape murder charges, to orchestrate the bombing of a synagogue in Essen. An alleged associate balked at bombing the synagogue but fired shots into its windows.
The point man in the Maryland plot was a “full patch” member named Damion Ryan, who has a string of convictions in Canada for crimes including drug trafficking, assault, robbery and home invasion, according to court records. Those documents list aliases for him including “Berserker” and “Mr. Wolf.”
Ryan, 43, in turn enlisted a younger Hells Angels affiliate, Adam R. Pearson, 29, who was in hiding in Minneapolis to escape arrest on murder charges in Canada, according to US and Canadian officials and court records. An attorney representing Ryan declined to comment. Attorneys who have previously represented Pearson did not respond to requests for comment. Photo from Canada's RCMP.
By March 2021, the Hells Angels pair had agreed on the six-figure price tag and Zindashti had sent photos and maps as well as an initial $20,000 payment to cover travel expenses, according to the US indictment. It is unclear how Iran identified the location of the defector. Then, just as it entered its final stage, the plot stalled. The indictment provides no explanation for why Pearson never made the trip to Maryland, but that same month security services in Europe achieved a breakthrough that rippled through criminal networks around the world.
Zindashti and the two Hells Angels members had been corresponding through an encrypted messaging service known as Sky ECC. Launched by a Vancouver-based company in 2008, the system became a mainstay among criminal syndicates by turning ordinary cellphones into seemingly impenetrable devices, disabling their cameras, microphones and GPS trackers while adding a “kill switch” to delete incriminating data.
By early 2021, however, Belgian and Dutch security services found a way to breach the network’s security. On 9 March, Belgian police carried out hundreds of raids, arrested dozens of alleged traffickers and seized 17 tons of cocaine. Among those taken into custody in Belgium and the Netherlands were members of Hells Angels. US officials said the Maryland plot came to their attention as investigators sifted through the Sky ECC trove. Pearson was arrested by the FBI in Minnesota and extradited to Canada. In February 2022, Ryan was arrested following a raid on his house in Ottawa, where authorities found a cache of weapons, body armor and roughly $95,000 in cash.
A drug lord in Tehran - Zindashti has emerged as a linchpin in Iran’s operations. A hulking figure who stands over 6 feet tall and weighs 250 pounds, Zindashti was described by one US intelligence analyst as a “Pablo Escobar-type narco-trafficker.” Now in his early 50s, Zindashti acquired that status after emerging triumphant from a bloody regional drug war touched off by one of the largest busts in European history. It involved a cargo ship named the Noor One that arrived at a Greek port in June 2014 carrying more than two tons of heroin. Zindashti was accused by some of tipping off authorities to undercut rivals. He has survived several attempts on his life, but his daughter and a nephew were killed in 2014 by gunmen who pulled up alongside their Porsche Cayenne in Istanbul, mistakenly believing Zindashti was in the vehicle, according to Turkish court records obtained by The Post. A brutal campaign of score-settling ensued in which more than a dozen people linked to the Noor One deal were killed. One of the murders had striking parallels to the Hells Angels plot that Zindashti is alleged to have later orchestrated on behalf of Iran’s MOIS.
In May 2016, a Turkish drug trafficker identified as Cetin Koc was gunned down in Dubai by two hit men who had traveled from Canada where they had links to local narcotics networks. The gunmen became targets themselves upon returning to Vancouver. The bullet-riddled body of one was found in a blueberry field and the remains of the other were recovered from a burned car, Canadian officials said.
In statements to Turkish investigators, Zindashti acknowledged that he had motive to kill Koc, saying that “he wrote me threatening messages about ten days before my daughter’s murder.” Still, Zindashti claimed to “have nothing to do with the murder” and dismissed the accusations as “a conspiracy.” As the killings continued, the target list expanded to include dissidents and journalists branded disloyal by Tehran.
In 2017, Saeed Karimian, the founder of a Persian language television network, GEM TV, was killed in Istanbul by suspects including a man that Zindashti acknowledged had worked as his family’s driver, according to the Turkish court records. In 2019, Masoud Molavi, a dissident who had created a popular Telegram channel that campaigned against corruption in Iran, was killed in Istanbul by an assailant who then hid in one of Zindashti’s apartments, according to the Turkish files, which refer to the drug lord as the “instigator” of multiple attacks. In 2020, Habib Chaab, a political activist living in Sweden, was abducted during a visit to Turkey and smuggled by Zindashti operatives to Iran where he was tortured and, in 2023, executed, US, Western and Turkish security officials said.
Zindashti’s ruthless effectiveness appears to have reignited Iran’s enthusiasm for working with criminal syndicates after experiments years earlier ended in failure, officials said. An attempt in 2011 to assassinate the Saudi ambassador at Café Milano, a Georgetown restaurant, unraveled when Iran enlisted a hapless used-car salesman from Texas — the cousin of an official in Tehran — to manage the plot.
Taking on these assignments may also have paved the way for Zindashti’s return several years ago to his native country after an arrest and other legal problems prompted him to abandon Istanbul. The apparent sanctuary provided Zindashti and Yektaparast suggests that Iran’s religious hard-liners are willing to accommodate criminals who are useful against their enemies, officials said. Yektaparast, who posted photos of his Lamborghini and other luxury trappings on an Instagram account, was killed by unknown assailants in Iran earlier this year. “Café Milano was, in hindsight, a signifier of things to come,” said a US intelligence analyst. But it was Zindashti, the analyst said, who brought a “significant shift in terms of realizing this is a lucrative tactic.”
Iran’s security services have poured additional resources into supporting such operations, officials said. The Quds Force, an elite paramilitary wing of the IRGC, established a special unit, Department 840, dedicated to assassination operations outside Iran, US and other officials said.
Zindashti has been more closely aligned with the MOIS, which functions as Iran’s main domestic security service but also has its own assassination branch, US officials said. Iranian nationals who oppose the government are considered “internal” adversaries, officials said, even when residing in others’ sovereign territory.
The US Treasury Department and its UK equivalent imposed financial sanctions on Zindashti earlier this year, saying that he had conducted “assassinations and kidnappings under the direction of the MOIS across multiple continents.” Even while taking advantage of Zindashti’s international reach, Iran has diversified.
A gunman who showed up at the Brooklyn doorstep of Iranian American journalist Masih Alinejad in July 2022 was a member of a sprawling criminal organization known as Thieves in Law. The phrase refers to a mafia-style honor code that sworn members are bound to follow. The assailant, Khalid Mehdiyev, was arrested after being pulled over for a traffic violation near Alinejad’s residence. Police found an AK-47, 66 rounds of ammunition and a ski mask in his vehicle, according to a US indictment. Charges have also been filed against two other suspected Thieves in Law members alleged to have given Mehdiyev his orders. One was based in Iran but apprehended in Uzbekistan and turned over to the United States in 2023, officials said. The other was also extradited earlier this year after being arrested in the Czech Republic.
The assassination attempt marked at least the third plot targeting Alinejad, a prominent advocate for women’s rights in Iran. One centered on an elaborate scheme to abduct her, escape New York by boat and board a flight to Iran from Venezuela, according to details released by the US Treasury Department when it imposed sanctions on security operatives in Iran. Alinejad said she has spent time in more than a dozen safe houses and that Iran’s use of criminals has deepened her concern for her safety. “There are a lot of people in Eastern Europe and other places and it’s very easy for them to get a visa and come here to do the job,” she said.
‘We’re coming for you’ - Iran has used that template repeatedly against Iran International, the satellite station whose journalists have been targets of at least five lethal plots. Launched in 2017, the network has built gleaming studios in a London business park and hired hundreds of employees, including prominent broadcasters from BBC Persian and other platforms. Despite negligible advertising revenue, the station spends lavishly on facilities and salaries, reporting losses totaling $569 million between 2017 and 2022, the latest year for which figures are available. Executives declined to provide details on the station’s funding except to acknowledge that much of it comes from sources in Saudi Arabia, one of Iran’s primary adversaries.
Viewership has surged, fueled by around-the-clock coverage of internal protests. During the 2022 uprisings that followed the death of Mahsa Amini, a 22-year-old woman beaten by police for alleged violations of the country’s religious dress code, the network aired coverage of the violent internal crackdown, showing videos of police beatings and other abuses submitted by activists and ordinary citizens.
As protests grew, IRGC commander Hossein Salami issued a thinly veiled threat to the network. “We warn those who manage these systems of spreading news and spreading lies for chaos inside our country to stop these behaviors,” he said. “You’ve tried us before. Watch out because we’re coming for you.” A month later, in November 2022, the station issued a news release saying it had been warned of bomb and death threats against two of its senior managers. Other plots followed, aimed at on-air broadcasters Fardad Farahzad and Sima Sabet.
In February 2023, police arrested a suspected associate of the Thieves in Law who had arrived in London on a flight from Vienna, went straight to Iran International’s headquarters and begun taking videos of its perimeter security. That same month, the channel moved its production operations to an existing Iran International studio in Washington, considered safer because of the distance from Tehran and the capabilities of US intelligence agencies.
The Thieves in Law suspect, Magomed-Husejn Dovtaev, a 31-year-old native of Chechnya, was convicted in December of conducting surveillance for an act of terrorism and given a three-and-a-half-year prison sentence. Three months later, a trio of alleged assailants arrived in London much as Dovtaev had, on flights from European countries that allow easy entry to Britain.
Zeraati considers himself more partisan commentator than impartial journalist, and the editorial tone of his weekly “Last Word” program may have made him a priority target. Several weeks before the stabbing, he had aired an interview with Israeli Prime Minister Benjamin Netanyahu, who used the appearance to denounce the IRGC as a “self-designated” terrorist organization.
Iran’s Fars News Agency responded by applying the same label to Iran International, calling it a “terrorist” channel that had “offered its antenna to the prime minister, murderer of children in Gaza.” Despite efforts to protect Zeraati, the attack exposed security lapses. Police had removed monitoring devices from his home a year earlier and though London is saturated with police surveillance cameras, none had been installed on Zeraati’s street.
Alicia Kearns, a member of British Parliament who was chairwoman of the Foreign Affairs Committee at the time of the stabbing, said in an interview that she was troubled that police had failed to stop the assailants before they could flee the country. “There are unfortunately going to be an increase in hostile states seeking to silence those who speak against them,” she said. “The UK can’t be a beacon of freedom and democracy if we can’t stop hostile states conducting acts of terrorism on our soil.”
Zeraati has pressed on with his program, but his life has been altered. After additional stays in safe houses, he and his wife decided this summer to move away from England. They now reside in Jerusalem, a city where they believed they would be safer, close to the regional stories he covers and where the station also has a studio. He no longer walks with a noticeable limp, he said, but bears scars that “will stay for a lifetime.”
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
[1] https://www.msn.com/en-us/news/world/iran-turns-to-hells-angels-and-other-criminal-gangs-to-target-critics/ar-AA1qroLZ/
Comments