Late last year, Roey – an Israeli citizen who lives and works in France – received a terrifying message from local security officials: An Iranian-directed terror cell plans to kill you. The French authorities received the warning from what they referred to as “a foreign intelligence service” and, according to a subsequent report in the German media, it was none other than the Israeli Mossad that had alerted a number of intelligence agencies across Europe. The Mossad itself declined to confirm the report, responding to Shomrim’s request for comment by saying that “intelligence agencies are constantly engaged in dialogue and cooperation to deal with threats.”

In the months that followed, Roey received several more such alerts and French authorities even suggested that he leave the country. He took these warnings with the utmost seriousness. He and his wife spent much of the next few months in Israel and, during the short periods when they had to be in France, they moved between no fewer than six different apartments.

Even though they took extraordinary precautions to remain safe, the stress was intense. In April this year, therefore, Roey’s wife contacted the DGSI – France’s internal security agency and the equivalent of Israel’s Shin Bet – to report an untoward incident. She told the French authorities that someone claiming to be a courier rang at the intercom of the family apartment. Since she was not expecting a delivery, she did not open the door – but she did manage to capture images of the individual on the intercom camera. The DGSI looked into the incident and concluded that the individual in question was probably a courier after all.

A few days later, members of the terror cell were arrested by French authorities. Documents and testimony regarding the cell’s operations, which are being revealed here for the first time, provide a rare glimpse into the workings of Iranian terrors cell in Europe which use figures from the criminal underworld: low- and high-ranking members of the local criminal class, gangs, drug smugglers, former convicts and others. This is not a “symbolic” modus operandi which takes advantage of frustrated and disenfranchised immigrants. Rather, these cells are planning and carrying out attacks and assassinations on a large scale. The cell that was arrested in France also planned to kill three other Israelis who work alongside Roey and three senior members of the Jewish community in Germany, in addition to being dispatched to set fire to buildings in the south of France belonging to Israeli-owned companies.

In order to maintain a degree of separation from the terror cells it operates in Europe and to ensure plausible deniability, there is no direct contact between Tehran and members of the cells. In the case of the recently detained French cell, instructions on where and when to carry out attacks were relayed via international networks of criminals and drug smugglers.

The investigation is based on documents from various European intelligence agencies obtained by independent French investigative online newspaper Mediapart, which were then analyzed by the European Investigative Collaborations (EIC) organization and journalists from nine outlets, including Mediapart, Der Spiegel in Germany, Spanish outlet Infolibre and organizations from the Netherlands, Norway, Denmark and Belgium. Shomrim’s Daniel Dolev was the Israeli partner in the project.

According to an internal document, the French security establishment believes that, after they took measures to ensure the safety of Roey and his family, the cell decided to move on and focus on its next targets. Roey – whose real name, like those of the cell’s other targets, is not being published for security reasons – has not responded to requests for comment sent to him via several channels.

The owner of the company that employed Roey, a former member of the security services, told Shomrim that he had not been contacted by any officials on the matter. “I have no idea what you are talking about,” he said. “If someone were to tell me that it’s real, it would be very scary – but apart from that I don’t feel that way.”

The investigation is based on documents from various European intelligence agencies obtained by independent French investigative online newspaper Mediapart, which were then analyzed by the European Investigative Collaborations (EIC) organization and journalists from nine outlets. Shomrim was the Israeli partner in the project.

A decade of collaboration with the underworld

Iran’s use of members of the criminal underworld and drug deals to carry out acts of terror is nothing new. In May, the Mossad revealed that a terror cell had been operating in Europe under the leadership of Rawa Majid, known as “the Kurdish Fox,” who also spearheaded a Swedish organized crime ring called Foxtrot. According to various reports in Israel, which cited Mossad officials, Majid fled from Turkey to Iran, where he was recruited after being arrested by Iranian police. Israeli security officials told Shomrim that the Swedish cell and the French cell were activated separately and that there was no communication between them.

The first evidence that Iran was using criminals in Europe emerged a decade ago. The main goal of the Islamic Republic was to assassinate members of the exiled Iranian opposition, as well as Jewish and/or Israeli targets. Since 2015, around 20 such attempts have been uncovered (see map). One of the first successful assassination came in December 2015, when Mohammad-Reza Kolahi Samadi, an activist in the People’s Mujahedin of Iran (MEK) who was convicted of planting a bomb at the Tehran headquarters of the Islamic Republican Party that killed more than 70 officials in 1981 – and had been in living in the Netherlands under an assumed identity ever since. He was murdered by local criminals, aided by Dutch and Belgian drug-smuggling gangs.

Iran’s tentacles | Acts of terror attributed to Iran on European soil over the past decade

“When it comes to exiled opposition figures, the Iranians have been running amok – unhindered and for years,” says Yoram Schweitzer, a senior research fellow at the Institute for National Security Studies and the director of its Research Program: Terrorism and Low-Intensity Conflict. “When it comes to Israelis, there are periods when there is more intense activity. We are currently in just such a period and have been for several years.”

The Iranian modus operandi began to change around 2018, when a senior Iranian official diplomat called Assadollah Assadi was arrested and convicted of plotting to bomb a big rally organized by an Iranian exile opposition group in France. Assadi, who lived in Europe on the pretext that he was a diplomat working at the Iranian Embassy in Vienna, was sentenced to 20 years in prison – but subsequently released as part of a prisoner-exchange deal. Even though the Iranians had used criminal organizations to carry out terror attacks before this, they decided in the aftermath of the Assadi affair to make this a key part of their strategy.

“There has been a very noticeable uptick in the use of criminal elements to carry out terrorist attacks,” Schweitzer adds. “The guiding principle for countries that support and orchestrate terror attacks is maintaining plausible deniability. Because, notwithstanding all of its violations, it still operates within a set of international norms and wants to maintain a façade of decency. So, the most important part of the process is to maintain that deniability and using the criminal element adds another degree of separation. Another layer of protection. That allows Iran to claim that these assassinations are criminal in nature, not political.”

Former Mossad agents, who agreed to talk to Shomrim on condition of anonymity, also commented on the connection between Iranian terror and the criminal underworld. They also pointed out that the international trade in narcotics is a significant source of income for the Islamic Republic – as it is for Hezbollah in Lebanon. “Our surveillance of the drug-smuggling trade as Hezbollah’s key economic lifeline reveals that the group is connected to all the [criminal] organizations, whether it’s in the Netherlands, Belgium, Sweden or Sri Lanka. There, they are on the same field as the big players,” one former Mossad agent told Shomrim. At the same time, he added, “if they have, let’s say, a smuggling route to Paris which brings in $10 million a year, and they use that money to carry out a terror attack, then it’s gone. And still, this connection creates relationships and the possibility of getting to know and then recruit people who are not directly connected to the smuggling operation but are from the criminal underworld.”

Former Mossad: “Our surveillance of the drug-smuggling trade as Hezbollah’s key economic lifeline reveals that the group is connected to all the [criminal] organizations, whether it’s in the Netherlands, Belgium, Sweden or Sri Lanka. There, they are on the same field as the big players,”

On the seam line between criminal activity and terrorism are international drug dealers. Earlier this year, the United States and the United Kingdom imposed sanctions on an Iranian narcotics trafficker called Naji Ibrahim Sharifi-Zindashti. According to American authorities, Zindashti and his network enjoy protection from the regime in Tehran and, in exchange, have carried out assassinations and kidnappings (some of which were foiled) for the Iranian Intelligence Ministry in the United Arab Emirates, the Netherlands, Turkey and even the United States.

Another similar case is that of Ramin Yektaparast, who, while not involved in trafficking narcotics, was a senior member of a German motorcycle gang and who German authorities suspected of murdering a member of a rival gang before fleeing to Iran. A court in Dusseldorf found that Yektaparast was responsible for organizing a Molotov cocktail attack on a synagogue in Bochum and that he was probably also responsible for a shooting attack on another synagogue, this one in nearby Essen. Yektaparast was shot dead in Tehran early this year in an operation that has been attributed to the Mossad.

Yoram Schweitzer: "The most important part of the process is to maintain that deniability and using the criminal element adds another degree of separation. Another layer of protection. That allows Iran to claim that these assassinations are criminal in nature, not political.”

The gang leader fled to Iran

French authorities believe that the terror cell operating on their soil was headed by a major drug dealer from the Lyon area called Umit Bulbul, who, as far as they are aware, is currently in Iran. Bulbul, who was born in Pau in southwestern France, had two known aliases. One of these was Ilan Isaac Hadjaj,  a French-born Jew. Another was a fictitious Turkish national called Harun Öztürk.

The cell’s operations were carried out by an Algerian-born French national known as Abdulkarim S., who was also known as Krimo. His full name cannot be published due to reporting restrictions in France. Krimo is well-known to French law-enforcement bodies, having served time for involvement in a gang warfare double murder in Marseilles and drug trafficking.

As part of Iran’s efforts to keep the various members of the network apart, Bulbul and Krimo were never in direct contact. Acting as their intermediary was Sedat (whose name cannot be published for similar reasons), who has a rich criminal record involving violence, theft, extortion and drug trafficking – and who is currently serving time in a French prison. It was almost natural that he would be selected as the go-between: he was one of Bulbul’s lieutenants in the gang’s narcotics enterprise and was a former cellmate of Krimo.

Krimo’s activation shows how the cell operated and what the Iranians were planning – including the fact that Tehran’s hit list included three senior members of the Jewish communities in Berlin and Munich. Although Krimo was barred from leaving France because of the conditions of his release from prison, acting on Iranian orders he traveled at least twice to Germany to collect intelligence on the targets. On one occasion, he traveled to Munich by train, having purchased a ticket using his brother-in-law’s identification documents and not before remembering to turn off his cellphone before leaving French territory. When he reached his hotel, he used his phone with a local SIM card.

During his time in the city, Krimo visited the quiet neighborhoods of the Au-Haidhausen borough. Not exactly a hot tourist destination – but Krimo had other intentions. Au-Haidhausen is the location of businesses belonging to two of the intended assassination victims. He walked past the premises several times, even entering the internal courtyard and taking videos and photographs of the surroundings, the entry door and the back and front entrances of adjacent buildings. He had no idea, of course, that he was being followed by undercover German intelligence agents the whole time.

Krimo spent a total of two days in Munich before returning to France. A week later, he once again boarded a train to Germany. When he alighted in Munich, on April 21st, he was stopped by local police and his documents were photographed. Even though he was under surveillance, this was actually a routine and random stop – but it concerned him. In a voice message he sent to an unknown recipient, he complained about the large police presence and returned to France two days later.

European authorities continued to surveil Krimo and members of his cell, but then something unexpected happened: German magazine Focus reported on the Mossad warning mentioned at the start of this article and added that a manhunt was underway for Krimo. Investigators were worried that he would flee and, the next day, he was arrested along with his wife, who was suspected of abetting him.

Under questioning, Krimo claimed that he had been working on behalf of a former cellmate, a young man of Turkish heritage called Emre, whose surname he never knew. He claimed that he met Emre in Lyon to get instructions and money from him – 1000 euros to take photographs of buildings in Germany. He said that Emra told him that the offices of companies that had defrauded a friend of his were located in these buildings. Although the story sounds far-fetched, it is not impossible that Krimo had no idea he was working for the Iranians.

Subsequently, according to Krimo’s testimony, Emre asked him to set fire to several buildings in southern France, explaining that it was for the purposes of insurance fraud. Krimo claimed that he had not carried out the arson attacks himself but had introduced Emre to other criminals. The buildings in question were torched in late November and early January and all were connected in some way to Israeli-owned companies. By the time of the arson attacks, the cell’s operations were known to French security authorities. What remains unknown for the time being is whether members of the cell managed to go under the French radar to carry out these firebombings or whether authorities allowed them to do so in order to keep monitoring the cell, collect more intelligence and avoid revealing their sources.

Another unresolved question is whether "Emre" is a name that Krimo invented to shield Sedat  and Bulbul from incrimination. When shown photographs of the two men, Krimo claimed he had never met them. However, there is evidence that suggests a connection. In November 2023, a seven-second phone call was made from a device used by Sedat  to Krimo’s wife’s cell phone. Furthermore, after Krimo and his wife were arrested, authorities searched Sedat’s prison cell and found a USB drive and three cell phones – at least one of which he had been using. That device contained Bulbul’s contact information in the Facebook Messenger app, while Krimo’s contact was saved in the Telegram app. During questioning, Krimo’s wife confirmed that she had heard him mention Sedat’s name. Krimo and his wife are currently awaiting trial in France.