Introduction

The Islamic Republic of Iran (IRI) has a longstanding history of conducting intelligence operations beyond its borders and targeting both political opponents and foreign governments. Since the 1979 Islamic Revolution, the regime has sought to expand its influence and suppress dissent through a combination of covert activities, such as terrorism, espionage, cyber operations, and influence campaigns. While significant attention has been given to the IRI’s intelligence activities in the Middle East, North America, and Western Europe, its operations in Scandinavia have received comparatively less scrutiny.

This report analyzes the IRI’s intelligence operations in Scandinavia with a focus on Denmark and Norway. Due to their smaller size and relatively limited political influence within the European Union (EU), these countries are often overlooked in discussions of Tehran’s foreign intelligence activities. This lack of attention on the part of the EU, combined with Denmark’s and Norway’s weak governmental response, has led the IRI to operate more freely in the region. Rather than deterring Tehran, the absence of firm consequences from these actors has signaled that the cost of exposure in Scandinavia remains low.

The IRI’s intelligence footprint in Scandinavia is not a recent phenomenon. Shortly after its establishment, the IRI began targeting members of the Iranian diaspora, many of whom had fled Iran due to political persecution. In its early years, the IRI’s intelligence services focused on monitoring and intimidating exiled dissidents, occasionally going so far as to carry out assassinations.¹ Over time, the regime’s methods have evolved to include cyber tactics, the creation of influence operations within academia and media circles, and partnerships with criminal organizations.² The IRI has also sought to recruit exiled Iranians to gain access to positions within influential institutions in their host countries.³ Furthermore, the regime has shown a willingness to carry out acts of terror not only against Iranian dissidents but also native Danes and Norwegians it perceives as hostile.⁴

In recent years, media investigations and legal proceedings have revealed the extent of the IRI’s intelligence presence in the region. However, most analyses have examined individual cases within specific countries and lack a broader, cross-national perspective. This report seeks to fill that gap by demonstrating that the IRI’s intelligence operations in Scandinavia are part of a systematic strategy rather than isolated incidents. It draws on open-source material, including publications from Scandinavian intelligence organizations, media articles, legal documents, and other publicly available sources.

The report provides a structured analysis of the IRI’s intelligence activities in Scandinavia, beginning with an explanation of the region’s strategic importance for Tehran. It then outlines the decision-making structures behind the IRI’s foreign and security policies, identifies the primary intelligence organizations involved, and provides an overview of the IRI’s global intelligence operations for context. Additionally, it presents cases of Iranian operations in both Denmark and Norway. Not all cases have been made public—and of those that have, not all will be examined here. Instead, a curated selection has been made to illustrate the breadth and variety of the regime’s operations.

By shedding light on the IRI’s intelligence activities in Scandinavia, this report deepens our understanding of the threats posed by Tehran’s covert operations. It stresses the need for greater vigilance and coordinated responses among Scandinavian governments to counter these threats. Given the increasing visibility of the IRI’s intelligence actions in the region, it is crucial to move beyond case-by-case investigations and recognize the broader patterns at play. This report serves as a first step in that direction, aiming to inform policymakers, security professionals, and the wider public about the scale and implications of the IRI’s intelligence operations in Denmark and Norway.

The Strategic Importance of Scandinavia

The IRI has long carried out intelligence operations in Scandinavia to monitor, pressure, and neutralize its opponents.⁵ While the Iranian diaspora in Denmark and Norway is relatively small, its members are highly educated and active in academia, media, and politics. For this reason, the regime considers them among its most influential adversaries. Their deep understanding of the IRI’s political system and tactics makes them particularly threatening to the regime.

Beyond targeting dissidents, the IRI seeks to expand its influence in other EU countries, including Sweden and Denmark. By exerting pressure, the regime aims to shape EU decision-making and access sensitive political and institutional information—particularly regarding the internal operations of various EU bodies—to extend its reach. Scandinavia’s world-class universities, advanced industries, and cutting-edge technological innovation make the region a particularly attractive target. Recognizing their value, Tehran strives to the acquire strategic knowledge, materials, and technology to strengthen its economy, military, and surveillance capabilities.⁶

Additionally, the IRI views political influence as a tool to undermine its adversaries, particularly Israel and the United States. By expanding its presence in Europe, it advances its own interests while limiting those of rival nations. Its designation of Sweden as a base for operations targeting Israeli interests highlights the region’s strategic value. Espionage and covert operations against U.S., Israeli, and broader Jewish targets remain a core priority for Tehran.⁷

Furthermore, the IRI’s close relationship with Russia plays a central role in its activities in Scandinavia. Tehran depends on Moscow for military, intelligence, political, and economic support, while Russia benefits from Tehran’s supply of kamikaze drones and ballistic missiles, which are deployed in its war against Ukraine. This collaboration poses a direct security threat to Europe. The IRI has also worked to obstruct Sweden’s NATO accession in alignment with Russia’s interests.⁸ Recently, Russia and the IRI signed a 20-year strategic agreement, further cementing their alliance.⁹According to the Swedish Security Service, Russia, China, and the IRI are collaborating to reshape the global order in line with their strategic interests.¹⁰

The Decision-Making Bodies Behind the IRI’s Foreign and Security Policy

The IRI is a totalitarian regime in which de jure and de facto authority rests with its Supreme Leader—Ali Khamenei. Since assuming power in 1989, Khamenei has systematically eliminated dissent and consolidated control over all state institutions. Through the Office of the Supreme Leader (Beyt-e Rahbari)—Khamenei’s administrative apparatus—he dictates key domestic and foreign policies, particularly those related to security and intelligence.¹¹

Khamenei’s authority is upheld through a network of institutions that report directly to him. The Guardian Council vets electoral candidates and approves legislation, ensuring that only loyalistshold political office. This process allows Khamenei to exert control over the president and foreign minister.¹² The judiciary, another instrument of repression, enforces the regime’s authority through politically motivated arrests, show trials, and executions. Clerics are kept in line through the Special Clerical Court, an independent body operating outside the regular judiciary. Meanwhile, state-controlled media and the education system promote ideological conformity through propaganda and disinformation.

Beyond these institutions, two key entities safeguard the regime’s interests: the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence (VAJA). Both report directly to the Supreme Leader and are tasked with domestic repression and foreign operations, including espionage, destabilization efforts, terrorism, and influence campaigns. Another critical institution is the Supreme National Security Council (SNSC), which brings together representatives from the government, parliament, the judiciary, the Guardian Council, the IRGC, the military, and the police. The SNSC appears to operate as a collective decision-making body, but ultimately all its decisions require the Supreme Leader’s final approval. The council plays a key role in shaping security strategies, military actions, intelligence operations, and foreign policy.¹³

Building on this framework, the IRI’s foreign policy is deeply influenced by the Umm al-Qura doctrine, which casts Iran as the leader of the Islamic world, responsible for spreading its revolutionary ideology.¹⁴ This doctrine justifies the IRI’s interventionist policies and places regime survival above both religious and national interests. To this end, religious institutions are coopted as instruments of covert operations, allowing Tehran to expand its influence under the guise of cultural or religious outreach. Through this highly centralized system, Khamenei maintains an iron grip on the country, ensuring that every institution functions in service of his authority and the regime’s broader Islamist objectives.

The IRI’s Intelligence Community

Since the 1979 revolution, the IRI has developed a complex and multifaceted intelligence apparatus, aimed at preserving the regime’s power and extending its influence both domestically and globally. This network comprises over a dozen agencies. The SNSC is tasked with coordinating their intelligence activities, ensuring they align with national security policies and the directives of Ali Khamenei. The IRI’s intelligence structure is dominated by the IRGC and VAJA. While VAJA serves as the regime’s civilian intelligence service, the IRGC operates as an independent military and intelligence branch. Both agencies are deeply involved in cyber warfare, terrorism, influence operations, and espionage, including industrial and research espionage.

The Islamic Revolutionary Guard Corps

The Islamic Revolutionary Guard Corps (IRGC or Sepah-e Pasdaran-e Enqelab-e Eslami) was established in 1979 as a paramilitary force designed to protect the Islamic Revolution. Over the decades, it has evolved into the IRI’s most powerful military and intelligence institution, wielding vast economic and political influence. Although it operates alongside the regular military, the IRGC holds far greater authority, particularly in strategic sectors such as missile development—through the IRGC Aerospace Force—and asymmetric warfare.¹⁵ The IRGC has been designated a terrorist organization by both the United States and Canada. Currently, the EU is considering a similar designation.¹⁶

(Shutterstock)

One of the most notorious divisions within the IRGC is the Quds Force, responsible for the IRI’s foreign operations. The Quds Force plays a leading role in training, financing, and arming the regime’s proxy organizations, including Hezbollah in Lebanon, Hamas in Gaza, the Houthis in Yemen, and various Shia militias in Iraq and Syria. Through these proxies, Iran has destabilized governments across the Middle East and expanded its regional influence while maintaining plausible deniability.¹⁷ A recent example is the Quds Force’s involvement in planning the Hamas October 7 terrorist attack against Israel.¹⁸

According to Argentinian investigators, the Quds Force was also behind the 1994 AMIA (Asociación Mutual Israelita Argentina) bombing in Buenos Aires, where the IRI, acting through Hezbollah, orchestrated a terrorist attack on a Jewish community center that killed 85 people.¹⁹ The IRGC has likewise been implicated in assassination plots in other countries, most notably France, Denmark, the Netherlands, Sweden and the United States. Their operations have targeted Iranian opposition figures within the diaspora, their non-Iranian counterparts and organizations deemed hostile by the regime. Beyond the Quds Force’s external operations, the IRGC Intelligence Organization (IO-IRGC) operates an extensive network dedicated to espionage, terrorism, and cyber warfare. Domestically, it plays a crucial role in suppressing dissent, while internationally, it works to expand the regime’s influence.

The Ministry of Intelligence

Founded in 1983, the Ministry of Intelligence (VAJA or Vezarat-e Ettela’at-e Jomhori-e Eslami) serves as the IRI’s civilian intelligence agency, responsible for domestic surveillance, the infiltration of opposition groups, foreign espionage, and global terrorism.²⁰ Although VAJA formally operates as a government ministry, the Supreme Leader Ali Khamenei retains final authority in the appointment of its minister.²¹ In January 2019, the EU designated VAJA’s Directorate for Internal Security a terrorist entity due to its involvement in thwarted attacks on European soil.²²

Under Esmaeil Khatib, the current Minister of Intelligence, VAJA has intensified its crackdown on opposition movements, working closely with the IRGC to silence dissidents inside and outside Iran. Khatib served as Minister of Intelligence under President Ebrahim Raisi and was retained by President Masoud Pezeshkian, highlighting his importance within the regime. Khatib’s close ties to both Ali Khamenei and the IRGC, which enhance intelligence coordination, explain why two presidents from different political factions within the regime have kept him in power.²³

Additionally, VAJA uses diplomatic covers for intelligence operations. A prime example is the 2018 arrest of Iranian diplomat Assadollah Assadi who had planned a bomb attack in Paris targeting opposition figures.²⁴ Assadi was later convicted in Belgium for his role in orchestrating the attack,highlighting the IRI’s use of embassies as operational hubs for intelligence activities. Asadi was eventually returned to Iran in a prisoner swap. Additionally, VAJA maintains close intelligence ties with Russia and China, benefitting from access to advanced surveillance technology, cyber warfare tools, and counterintelligence training.²⁵

Global Intelligence Operations

Since 1979, the IRI’s intelligence agencies have carried out over 160 assassinations of political opponents with operations spanning Europe, North America, and the Middle East. The IRI often uses local intermediaries and mercenaries to carry out these killings.²⁶ Some of the most infamous assassinations include:

• Prince Shahriar Shafigh (Paris, 1979): An officer in the Imperial Iranian Military, loyal to the last Shah of Iran, Mohammad Reza Pahlavi, who was toppled in the 1979 Islamic Revolution; shot in a targeted attack by agents of the Islamic Republic.
• Shapour Bakhtiar (Paris, 1991): Iran’s last prime minister under Shah Mohammad Reza Pahlavi; assassinated by intruders in his residence.
• Mykonos Assassinations (Berlin, 1992): A targeted attack in which four Iraniandissidents were killed; Germany later attributed the plot to the IRI’s top leadership.
• Reza Mazlouman (Paris, 1996): A former Iranian deputy minister in the Pahlavi regime and a vocal critic of the IRI; shot and killed in his residence.

More recently, in 2011, U.S. authorities foiled an Iranian plot to assassinate the Saudi ambassador in Washington, D.C. by using Mexican drug cartels as intermediaries.²⁷ Likewise, in 2018, European intelligence agencies prevented a major terrorist attack in Paris, orchestrated by VAJA through its diplomat, Assadollah Assadi.

Espionage is another key pillar of the IRI’s operations. The IRGC and VAJA maintain extensive networks of informants, spies, and terrorists across Europe and North America. These networks conduct surveillance on Iranian exiles, recruit sympathizers, and attempt to influence political decision-making.²⁸ Several Iranian operatives have been arrested worldwide, including in Sweden and Germany, for spying on dissidents.²⁹ Iran also leverages its presence in Latin America to smuggle weapons, establish intelligence hubs, and expand its influence through proxies, such as Hezbollah.³⁰

A crucial aspect of the IRI’s intelligence activities is its use of embassies as operational centers. Iranian diplomats have been expelled from countries, such as France, Germany, the Netherlands,Norway, and Sweden, after being linked to assassination attempts or espionage. Thus, Iranian embassies serve as command and logistical hubs for both espionage and terrorism planning, exploiting diplomatic immunity to evade prosecution.³¹

The IRI’s Cyber Warfare Capabilities

Over the last two decades, the IRI has emerged as a major player in cyber operations, employing digital tools for espionage, sabotage, and influence campaigns. This expanded role underscores the necessity for closer scrutiny of its cyber capabilities. The IRGC and VAJA have conducted cyberattacks against individual opponents, critical infrastructure, state institutions, and private enterprises. Notable larger cyber attacks include:

· The Shamoon Virus Attack on Saudi Aramco (2012): This attack destroyed 30,000 computers.³²

· Operation Cleaver (2012-2014): A cyber campaign in which Iranian hackers targeted infrastructure, energy, and transport companies worldwide over a span of at least two years.³³

· The Attempted Sabotage of Israel’s Water System (2020): A cyberattack aimed at poisoning civilian water supplies that was thwarted before harm occurred.³⁴

· The Large-Scale Cyberattack Against Albania (2022): This attack crippled government networks and led to a diplomatic fallout between the IRI and Albania.³⁵

The IRI also conducts disinformation campaigns, utilizing fake news networks, AI-generated content, and deep fake technology to manipulate public opinion, particularly during elections in Western countries.³⁶ Additionally, the regime employs the internet for character assassination, aiming to discredit and undermine political opponents, dissidents, and critics both inside and outside Iran. In 2021, the IRI signed the Iran-Russia Cyber Pact, a cooperation agreement with Russia, strengthening its ability to conduct cyber intelligence operations and enhancing its surveillance infrastructure.³⁷Tehran has also imported Chinese surveillance technology to strengthen its censorship and monitoring capabilities.³⁸

Intelligence Operations in Denmark

The Danish Security and Intelligence Service (PET) has repeatedly raised concerns about the IRI’s security threat to Denmark. In its 2023 assessment, PET highlighted the IRI’s intelligence activities, including operations against dissidents and efforts to illegally acquire Danish products and technology.³⁹ Recently, PET launched a campaign to raise awareness about the importance of safeguarding research, reflecting growing concerns over espionage activities against Danish universities.⁴⁰ Over a year ago, Aarhus University, in cooperation with PET, initiated a pilot project that conducted background checks on researchers from Iran, Russia, and China. This initiative, which will become permanent at Aarhus University and will expand to other Danish universities, underscores the seriousness of the IRI’s intelligence operations in Denmark and its persistent efforts to infiltrate academic and technological institutions.⁴¹

(Original illustration)

Cyber Espionage Against Danish Universities

Among its various tactics, the IRI intelligence has utilized cyber espionage to target Danish institutions. The Centre for Cyber Security (CFCS), Denmark’s national IT security authority, has reported that the IRI’s cyber intrusions focus on acquiring scientific and technological expertise.⁴² These attacks align with the IRI’s broader intelligence objectives, which include circumventing Western sanctions and strengthening its military, surveillance, and cyber capabilities. This pattern of cyber espionage in Denmark mirrors similar operations across Europe where regime operatives attempt to obtain dual-use technology and sensitive research, often under the guise of academic collaboration. The CFCS report also highlights that the hacker group Silent Librarian (also known as Cobalt Dickens and TA407), linked to the IRGC, has carried out cyber operations against Danish universities.

Terrorist Attacks Against the Embassy of Israel

Beyond cyber espionage, the regime’s intelligence has also orchestrated terrorist attacks in Denmark. In October 2024, the IRI reportedly used a Swedish criminal network (the Foxtrot network) to carry out an attack on the Israeli embassy in Copenhagen. This incident highlights how the regime outsources its operations to third-party actors.⁴³ It also serves as another example of the IRI’s strategy of leveraging criminal and proxy networks to target adversaries in Europe while maintaining plausible deniability.

The Assassination Plot Agaist the Leader of the ASMLA

The IRI has been linked to an assassination plot in Denmark. In 2018, the Islamic regime planned to assassinate Habib Yabor Kabi, a leader of the Arab Struggle Movement for the Liberation of Ahvaz (ASMLA). Danish authorities uncovered the plan, prompting a nationwide security operation and escalating diplomatic tensions between Denmark and the IRI. Muhammad Davoudzadeh Loloei, a Norwegian citizen of Iranian origin, was convicted of spying for the IRI’s intelligence and aiding the assassination attempt.⁴⁴ He had gathered intelligence on the target in Denmark and passed it to Tehran, which then sought to eliminate the dissident on Danish soil. Eventually, in 2020, Loloei was sentenced to seven years in prison and permanent expulsion from Denmark upon the completion of his sentence.

This plot reflects the IRI’s broader strategy of extraterritorial repression in which its intelligence operatives track, monitor, and attempt to assassinate opposition figures abroad. While Denmark responded with diplomatic pressure in 2018, the IRI has continued its intelligence operations in the country. Subsequently, Danish authorities arrested three ASMLA leaders, convicting them of supporting terrorism in Iran and spying for Saudi Arabian intelligence.⁴⁵

Political Pressure and the Mohammad Cartoons

The IRI’s intelligence activities in Denmark extend beyond espionage, terrorism, and assassinations to include political and ideological pressure. A key example was the IRI’s response to the publication of the Mohammad cartoons by the Danish newspaper Jyllands-Posten in 2005. These cartoons sparked outrage across the Muslim world, especially when the media in other European countries published them. The IRI used the controversy as a geopolitical tool to put pressure on Denmark and other Western nations. Tehran orchestrated protests, issued diplomatic condemnations, and encouraged economic boycotts against Danish products. The Danish, Austrian, and British embassies in Tehran were attacked by regime supporters, while IRI officials attempted to force Denmark to apologize and act against the newspaper, positioning itself as the leader of the Islamic world.⁴⁶

The IRI’s response to the Mohammad cartoons aligned with its broader ideological strategy of exporting its revolution and mobilizing Islamist sentiment against the West. The regime capitalized on the controversy to reinforce its anti-Western narrative, portraying Denmark as an enemy of Islam and using it to justify broader hostility toward the West.

Intelligence Operations in Norway

The Norwegian Police Security Service (PST) has consistently identified the IRI as a significant security threat to Norway. In its 2024 National Threat Assessment, the PST highlighted Tehran’s intelligence activities, including espionage, cyber intrusions, extraterritorial repression, and the illicitacquisition of Norwegian research, technology, and production infrastructure for military use.⁴⁷

The Assassination Attempt on William Nygaard

One of the most notable cases of IRI involvement in politically motivated violence in Norway was the 1993 assassination attempt on William Nygaard, the Norwegian publisher of Salman Rushdie’s novel The Satanic Verses. In 1993, Nygaard was shot three times outside his home in Oslo butsurvived the attack. While Norwegian authorities did not publicly identify the perpetrators at the time, the attack was widely believed to be linked to the 1989 fatwa issued by the IRI’s founder and leader Ayatollah Ruhollah Khomeini against Rushdie and those involved in publishing his book.⁴⁸

(Eirik Solheim via Wikimedia Commons)

In 2023, newly declassified documents from the PST’s predecessor pointed to the IRI embassy in Oslo and an IRGC-connected diplomat as having played a role in the assassination attempt.⁴⁹ In 2018, the diplomat was formally charged by Norwegian authorities, as police believed he had been involved in planning the attack.⁵⁰ However, in 2024, the case was closed. Norway had no means of continuing the investigation since the diplomat connected to the assassination plot fled Norway following the attempt. While definitive conclusions have not yet been reached, the findings have raised further suspicions regarding the IRI’s involvement. The fatwa against Rushdie and the Nygaard case exemplify the IRI’s broader history of using or inciting violence to advance its ideological agenda beyond its borders. As Norwegian State Prosecutor Lars Erik Alfheim has stated:⁵¹

There is nothing in the investigation of the Nygaard case that, with any significant weight, suggests that there could have been any other motive for attempting to take Nygaard’s life than the fact that he published The Satanic Verses.

The Assassination Attempt on a Pro-Israel Norwegian

In 2016, the PST apprehended an IRGC Quds Force agent in the garden of a high profile, native Norwegian pro-Israel advocate. The agent had been under PST surveillance from the moment he entered Norway. Following his arrest, Norwegian authorities quickly expelled him back to Iran.⁵²According to the victim, the operation was, at best, an intelligence-gathering mission or attempt to intimidate pro-Israel figures into silence. At worst, it was the beginning of an assassination plot. The incident underscores the IRI’s persistent efforts to monitor and potentially intimidate individuals and groups who support Israel within Scandinavian countries.

The Surveillance and Harassment of Dissidents

The Islamic regime has a documented history of monitoring and intimidating exiled opposition figures in Norway. A notable case involves Mohammad Movahed, a diplomat stationed at the IRI embassy in Oslo during the early 1990s. While officially assigned consular duties, Movahed clandestinely engaged in espionage, recruiting Iranian refugees as informants to infiltrate dissident communities. His covert operations were exposed by the Norwegian security service in 1994, leading to his expulsion from Norway.⁵³

Similarly, in 1996, another diplomat, Saberi Moghaddam, operated under a false identity while surveiling an exiled Iranian opposition figure, Fereshteh Yegneh, scheduled for a lecture tour in Norway. The discovery of Moghaddam’s activities led to the postponement of the visit due to security concerns, highlighting the IRI’s extensive efforts to suppress dissent beyond its borders.⁵⁴

In addition to leveraging diplomatic channels, the IRI has utilized religious institutions to further its intelligence objectives. The Tveita Mosque in Oslo became a focal point of concern when Norwegian authorities identified its imam as an intelligence operative. Investigations revealed that the imam was involved in gathering information on dissidents within the Iranian-Norwegian community.⁵⁵ The imam also had a connection with Muhammad Davoudzadeh Loloei, the Iranian-Norwegian terrorist convicted in Denmark for his role in the assassination plot against the leader of the ASMLA.⁵⁶ This case exemplifies the IRI’s strategy of using religious institutions as fronts for intelligence operations, a tactic observed across Europe. Regime-affiliated mosques and cultural centers serve as hubs for monitoring dissidents and extending the regime’s influence.

Beyond physical surveillance, the IRI employs sophisticated cyber-espionage techniques to infiltrate the personal devices of Iranian dissidents in Norway.⁵⁷ According to the PST, Iranian intelligence utilizes malware delivered through deceptive SMS messages and emails to compromise mobile phones and computers. Once these devices are infected, attackers gain access to sensitive information, including personal communications, schedules, contact lists, photos, and other private data. This digital intrusion facilitates the monitoring of dissident activities. It also serves as a tool for intimidation and control, reflecting the IRI’s commitment to suppressing opposition through multifaceted and extensive surveillance methods.

Spying on the U.S. Embassy in Oslo

In November 2024, a Norwegian citizen was arrested and charged with espionage after it was discovered that he had contacted intelligence services from both the IRI and Russia following the outbreak of the Gaza war. The individual, who had been employed as a security guard at the U.S. Embassy in Oslo, was accused of sharing sensitive information with these foreign governments in exchange for financial compensation. During his interrogation, he admitted to passing on information to the IRI and Russia, citing his motivations as being linked to U.S. support for Israel.⁵⁸

This case raises significant concerns about the potential coordination between the IRI and Russian intelligence operations targeting Norway and its allies. Moreover, the arrest highlights how the IRI’s intelligence services exploit geopolitical crises to expand their espionage networks against adversary states.

Cyber Espionage

In 2018, the IRI orchestrated cyberattacks against the University of Oslo and the University of Bergen. These attacks were part of a global hacking campaign carried out by individuals affiliated with the Mabna Institute, a group linked to the IRGC and focused on stealing research data.⁵⁹Known as the Silent Librarian, the Mabna Institute has conducted similar cyber intrusions against Danish universities, as discussed above.⁶⁰

The phishing operation in Norway targeted 43 top Norwegian researchers. It tricked them into divulging their login credentials, which were then used to access academic databases. The FBI has linked this group to attacks on over 300 universities across 21 countries, reinforcing concerns about the IRI’s systematic use of cyber espionage to bypass sanctions and acquire restricted scientific knowledge.⁶¹

Conclusion

The Islamic Republic of Iran’s intelligence operations in Denmark and Norway reflect a deliberate, long-term strategy to suppress dissent, gather strategic intelligence, and advance Tehran’s geopolitical and ideological objectives. Through a combination of espionage, cyberattacks, influence operations, and even acts of terrorism and assassination, the IRI has systematically targeted dissidents, institutions, and individuals deemed adversarial. These activities are not isolated incidents but part of a broader, coordinated campaign orchestrated by the regime’s highest authorities. The lack of a robust and unified response from Scandinavian governments has emboldened Tehran, reinforcing its perception that the region poses a low-risk, high-reward environment for intelligence activities. As the IRI continues to expand its global footprint, it is imperative for Denmark, Norway, and their European partners to adopt a more cohesive and proactive strategy to counter this growing threat. Increased vigilance, strengthened security measures, and greater public awareness are critical to safeguarding national sovereignty, academic integrity, and democratic values against the covert influence of the Islamic Republic.

¹ https://ardavan.se/rafsanjani-ahmad-reza-jalali-och-konsten-att-manipulera/

² https://pet.dk/-/media/mediefiler/pet/dokumenter/analyser-og-vurderinger/vurdering-af-spionagetruslen-mod-danmark/vurdering-af-spionagetruslen-mod-danmark-2023_dk_web.pdf; https://sakerhetspolisen.se/ovriga-sidor/nyheter/nyheter/2024-05-30-iran-anvander- kriminella-i-sverige.html; https://www.dn.se/sverige/iran-anvander-sig-av-kriminella-gang-i-fler-lander/; https://content.iranintl.com/en/investigates/inside-tehran-softwar/index.html; and https://www.tv4.se/artikel/4f72OQx4G6N0Mk0NTxiX8Y/iranexperten-rouzbeh-parsi-kopplas-till-paverkansnaetverk

³ https://www.tv4.se/artikel/3NSKIhooInC1dFVHCwos4G/misstanken-irans-ambassad-foersoekte-rekrytera-svensk-polis

⁴ https://www.expressen.se/nyheter/sverige/iranskt-agentpar-misstanks-ha-planerat-mord-pa-svenskar/; and https://www.nrk.no/norge/nygaard- saken_-pst-var-pa-sporet-av-iran-for-nygaard-ble-skutt-1.16846451

⁵ https://pet.dk/-/media/mediefiler/pet/dokumenter/analyser-og-vurderinger/vurdering-af-spionagetruslen-mod-danmark/vurdering-af- spionagetruslen-mod-danmark-2023_dk_web.pdf; https://sakerhetspolisen.se/download/18.5cb30b118d1e95affec37/1708502268494/L%C3%A4gesbild%202023-2024.pdf; and https://www.pst.no/globalassets/2025/nasjonal-trusselvurdering-2025/nasjonal-trusselvurdering-2025_no_web.pdf

⁶
https://pet.dk/-/media/mediefiler/pet/dokumenter/analyser-og-vurderinger/vurdering-af-spionagetruslen-mod-danmark/vurdering-af- spionagetruslen-mod-danmark-2023_dk_web.pdf; https://sakerhetspolisen.se/download/18.5cb30b118d1e95affec37/1708502268494/L%C3%A4gesbild%202023-2024.pdf; and https://www.pst.no/globalassets/2025/nasjonal-trusselvurdering-2025/nasjonal-trusselvurdering-2025_no_web.pdf

⁷ https://www.pst.no/globalassets/2025/nasjonal-trusselvurdering-2025/nasjonal-trusselvurdering-2025_no_web.pdf8
https://www.pst.no/globalassets/2025/nasjonal-trusselvurdering-2025/nasjonal-trusselvurdering-2025_no_web.pdf

⁸
https://www.altinget.se/artikel/islamiska-regimen-i-iran-hetsar-mot-sverige; https://omni.se/expert-fick-faktisk-effekt-intradet-i-nato-forsenades/a/1MjK0X

⁹ https://www.sverigesradio.se/artikel/ryssland-och-iran-fordjupar-samarbetet-iranexperten-otroligt-viktigt-for-regimen

¹⁰ https://sakerhetspolisen.se/download/18.5cb30b118d1e95affec37/1708502268494/L%C3%A4gesbild%202023-2024.pdf

¹¹ https://onlinelibrary.wiley.com/doi/10.1111/mepo.12400; and Yvette Hovsepian-Bearce, The Political Ideology of Ayatollah Khamenei—Out of the Mouth of the Supreme Leader (Routledge, 2016); and Arvin Khoshnood, “Sista ordet—Beslutsfattande i Islamiska republiken Irans utrikespolitik,” Orientaliska studier 130 (2012): 16–48 (hereafter Khosnood, ”Sista ordet”).

12 https://besacenter.org/irans-presidential-elections-have-nothing-to-do-with-democracy/

¹³ https://www.tandfonline.com/doi/pdf/10.1080/08850607.2023.2295205

¹⁴ https://besacenter.org/armenia-azerbaijan-conflict-iran/

¹⁵ Ardavan Khoshnood, “The Role of the Qods Force in the Foreign Policy of the Islamic Republic of Iran,” Central European Journal of International and Security Studies 14, no. 3 (2020): 4-33 (hereafter Khoshnood, “Role of the Qods Force”).

¹⁶ https://www.dni.gov/nctc/ftos/irgc_fto.html; https://www.canada.ca/en/public-safety-canada/news/2024/06/government-of-canada-lists- the-irgc-as-a-terrorist-entity.html; https://www.reuters.com/world/eu-lawmakers-want-irans-guards-branded-terrorist-group-2023-01-18/; and https://www.euronews.com/my-europe/2024/10/11/the-eu-has-found-the-legal-way-to-label-irans-revolutionary-guard-as-terrorist-group

¹⁷ Ibid.

¹⁸ https://www.mizanonline.ir/00Jzy8

¹⁹ Khoshnood, “Role of the Qods Force.”

²⁰ Carl Anthony Wege, “Iranian Intelligence Organizations,” International Journal of Intelligence and Counterintelligence 10, no. 3 (1997): 287-298; and https://besacenter.org/iran-is-a-threat-to-swedish-national-security/

²¹ Khosnood, “Sista ordet.”

²² https://www.consilium.europa.eu/en/press/press-releases/2019/01/09/fight-against-terrorism-council-renews-the-designations-on-the-eu- terrorist-list-and-adds-two-iranian-individuals-and-one-iranian-entity-in-response-to-recent-foiled-attacks-on-european-soil/

²³ https://besacenter.org/esmaeil-khatib-iran-intelligence/

²⁴ Ardavan M. Khoshnood and Arvin Khoshnood, “The Islamic Republic of Iran’s Use of Diplomats in Its Intelligence and Terrorist Operations Against Dissidents: The Case of Assadollah Assadi,” International Journal of Intelligence and Counterintelligence 37, no. 3 (2024): 976-992 (hereafter Khoshnood and Khoshnood, “Islamic Republic of Iran’s Use of Diplomats”).

²⁵ https://besacenter.org/iran-china-deal-security-implications/; and https://besacenter.org/russia-iran-intelligence-pact/

²⁶ Ardav Khoshnood, “Iran’s Killing Machine: Political Assassinations by the Islamic Regime,” Mideast Security and Policy Studies 185 (2020): 1-18.

²⁷ https://www.justice.gov/opa/pr/two-men-charged-alleged-plot-assassinate-saudi-arabian-ambassador-united-states

²⁸ Khoshnood, “The Role of the Qods Force”; and https://besacenter.org/iran-is-a-threat-to-swedish-national-security/

²⁹ https://besacenter.org/iran-is-a-threat-to-swedish-national-security/; and https://www.washingtoninstitute.org/sites/default/files/pdf/Levitt- 20180808-CTCSentinel.pdf

³⁰ Khoshnood, “The Role of the Qods Force.”

³¹ Khoshnood and Khoshnood, “Islamic Republic of Iran’s Use of Diplomats.”

³² Christopher Bronk and Eneken Tikk-Ringas, “The Cyber Attack on Saudi Aramco,” Survival 55, no. 2 (2013): 81-96.

³³ https://www.reuters.com/article/2014/12/02/us-cybersecurity-iran-idUSKCN0JG18I20141202/

³⁴ https://www.aronheller.com/articles/israeli-cyber-chief-major-attack-on-water-systems-thwarted/

³⁵ https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a

³⁶ Carl Anthony Wege, “Iranian Counterintelligence, ” International Journal of Intelligence and Counterintelligence 32, no. 2 (2019): 272-294 (hereafter Wege, “Iranian Counterintelligence”); and https://www.justice.gov/opa/pr/two-iranian-nationals-charged-cyber-enabled-disinformation-and-threat-campaign-designed

³⁷ https://besacenter.org/iran-china-deal-security-implications/; and https://besacenter.org/russia-iran-intelligence-pact/

³⁸ Wege, “Iranian Counterintelligence.”

³⁹ https://pet.dk/-/media/mediefiler/pet/dokumenter/analyser-og-vurderinger/vurdering-af-spionagetruslen-mod-danmark/vurdering-af- spionagetruslen-mod-danmark-2023_dk_web.pdf

⁴⁰ https://pet.dk/sikkerforskning

⁴¹ https://www.dr.dk/nyheder/indland/universiteter-vil-forhindre-spionage-med-baggrundstjek-det-er-skraemmende-man-er

⁴²
https://www.cfcs.dk/globalassets/cfcs/dokumenter/trusselsvurderinger/en/cyber-espionage-against-danish-research-and-universities.pdf

⁴³
https://www.dr.dk/nyheder/indland/live-eksplosioner-i-naerheden-af-israels-ambassade-i-koebenhavn; https://www.svt.se/nyheter/inrikes/uppgifter-dad-mot-ambassader-i-stockholm-och-kopenhamn-ska-ha-utforts-pa-uppdrag-av-foxtrot

⁴⁴ Roskilde Court (Denmark), Court Decision, Case 9-2075/2020, June 26, 2020; Arvin Khoshnood, “Terrorism och desperation—när en nationalistisk våg av protester sköljer fram i Iran,” Orientaliska studier 157 (2019): 16-31; and https://www.reuters.com/world/middle-east/danish-high- court-upholds-conviction-norwegian-man-iran-spy-case-2021-05-06/

⁴⁵ https://pet.dk/-/media/mediefiler/pet/dokumenter/analyser-og-vurderinger/vurdering-af-spionagetruslen-mod-danmark/vurdering-af- spionagetruslen-mod-danmark-2023_dk_web.pdf

⁴⁶ https://danmarkshistorien.dk/vis/materiale/karikaturkrisens-kronologi-2005-2006; and https://nyheder.tv2.dk/2005-12-03-sagen-om-tegningerne-af-muhammed

⁴⁷ https://www.pst.no/globalassets/2024/nasjonal-trusselvurdering-2024/nasjonal-trusselvurdering-2024_uuweb.pdf

⁴⁸
https://www.nrk.no/norge/nygaard-saken_-pst-var-pa-sporet-av-iran-for-nygaard-ble-skutt-1.16846451

⁴⁹ Ibid.

⁵⁰ https://www.nrk.no/dokumentar/nrk-avslorer_-var-diplomat-ved-irans-ambassade-i-oslo-_-siktet-for-nygaard-attentatet-i-1993-1.15722722

⁵¹ https://www.nrk.no/norge/nygaard-saken_-pst-var-pa-sporet-av-iran-for-nygaard-ble-skutt-1.16846451

⁵² https://www.tv2.no/nyheter/innenriks/pst-stanset-iransk-agent-i-hagen-til-nordmann/11129942/

⁵³ https://www.nrk.no/norge/irans-grenselose-jakt-pa-opposisjonelle-1.15150193

⁵⁴ Ibid.

⁵⁵ https://www.dagbladet.no/nyheter/spillet-rundt-spion-imamen/73050952

⁵⁶ https://www.nrk.no/norge/tveita-moske_-pst-vil-utvise-imam-fra-oslo-moske-1.15235570

⁵⁷ https://www.nrk.no/norge/iransk-etterretning-tar-seg-inn-i-mobiltelefoner-i-norge-1.16308804

⁵⁸ https://www.nrk.no/norge/spionsiktet-nordmann-i-retten_-kontaktet-iran-og-russland-etter-gaza-krigen-1.17179368

⁵⁹ https://www.nrk.no/norge/pst_-_-iran-bak-hacking-av-norske-universiteter-1.14044442

⁶⁰ https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian

⁶¹ https://www.nrk.no/norge/pst_-_-iran-bak-hacking-av-norske-universiteter-1.14044442