Iran used criminals and drug dealers in Europe to target

The Mossad itself declined to confirm the report, responding to Shomrim’s request for comment by saying that “intelligence agencies are constantly engaged in dialogue and cooperation to deal with threats.”

In the months that followed, Roey received several more such alerts and French authorities even suggested that he leave the country. He took these warnings with the utmost seriousness. He and his wife spent much of the next few months in Israel and, during the short periods when they had to be in France, they moved between no fewer than six different apartments.

Even though they took extraordinary precautions to remain safe, the stress was intense. In April this year, therefore, Roey’s wife contacted the DGSI – France’s internal security agency and the equivalent of Israel’s Shin Bet – to report an untoward incident.

She told the French authorities that someone claiming to be a courier rang at the intercom of the family apartment. Since she was not expecting a delivery, she did not open the door – but she did manage to capture images of the individual on the intercom camera. The DGSI looked into the incident and concluded that the individual in question was probably a courier after all.

A few days later, members of the terror cell were arrested by French authorities. Documents and testimony regarding the cell’s operations, which are being revealed here for the first time, provide a rare glimpse into the workings of Iranian terrors cell in Europe which use figures from the criminal underworld: low- and high-ranking members of the local criminal class, gangs, drug smugglers, former convicts and others.

This is not a “symbolic” modus operandi which takes advantage of frustrated and disenfranchised immigrants. Rather, these cells are planning and carrying out attacks and assassinations on a large scale. The cell that was arrested in France also planned to kill three other Israelis who work alongside Roey and three senior members of the Jewish community in Germany, in addition to being dispatched to set fire to buildings in the south of France belonging to Israeli-owned companies.

In order to maintain a degree of separation from the terror cells it operates in Europe and to ensure plausible deniability, there is no direct contact between Tehran and members of the cells. In the case of the recently detained French cell, instructions on where and when to carry out attacks were relayed via international networks of criminals and drug smugglers.

The investigation is based on documents from various European intelligence agencies obtained by independent French investigative online newspaper Mediapart, which were then analyzed by the European Investigative Collaborations (EIC) organization and journalists from nine outlets, including Mediapart, Der Spiegel in Germany, Spanish outlet Infolibre and organizations from the Netherlands, Norway, Denmark and Belgium. Shomrim’s Daniel Dolev was the Israeli partner in the project.

According to an internal document, the French security establishment believes that, after they took measures to ensure the safety of Roey and his family, the cell decided to move on and focus on its next targets. Roey – whose real name, like those of the cell’s other targets, is not being published for security reasons – has not responded to requests for comment sent to him via several channels.

The owner of the company that employed Roey, a former member of the security services, told Shomrim that he had not been contacted by any officials on the matter. “I have no idea what you are talking about,” he said. “If someone were to tell me that it’s real, it would be very scary – but apart from that I don’t feel that way.”

Iran’s use of members of the criminal underworld and drug deals to carry out acts of terror is nothing new. In May, the Mossad revealed that a terror cell had been operating in Europe under the leadership of Rawa Majid, known as “the Kurdish Fox,” who also spearheaded a Swedish organized crime ring called Foxtrot.

According to various reports in Israel, which cited Mossad officials, Majid fled from Turkey to Iran, where he was recruited after being arrested by Iranian police. Israeli security officials told Shomrim that the Swedish cell and the French cell were activated separately and that there was no communication between them.

The first evidence that Iran was using criminals in Europe emerged a decade ago. The main goal of the Islamic Republic was to assassinate members of the exiled Iranian opposition, as well as Jewish and/or Israeli targets. Since 2015, around 20 such attempts have been uncovered (see map).

One of the first successful assassination came in December 2015, when Mohammad-Reza Kolahi Samadi, an activist in the People’s Mujahedin of Iran (MEK) who was convicted of planting a bomb at the Tehran headquarters of the Islamic Republican Party that killed more than 70 officials in 1981 – and had been in living in the Netherlands under an assumed identity ever since. He was murdered by local criminals, aided by Dutch and Belgian drug-smuggling gangs.

“When it comes to exiled opposition figures, the Iranians have been running amok – unhindered and for years,” says Yoram Schweitzer, a senior research fellow at the Institute for National Security Studies and the director of its Research Program: Terrorism and Low-Intensity Conflict. “When it comes to Israelis, there are periods when there is more intense activity. We are currently in just such a period and have been for several years.”

The Iranian modus operandi began to change around 2018, when a senior Iranian official diplomat called Assadollah Assadi was arrested and convicted of plotting to bomb a big rally organized by an Iranian exile opposition group in France.

Assadi, who lived in Europe on the pretext that he was a diplomat working at the Iranian Embassy in Vienna, was sentenced to 20 years in prison – but subsequently released as part of a prisoner-exchange deal. Even though the Iranians had used criminal organizations to carry out terror attacks before this, they decided in the aftermath of the Assadi affair to make this a key part of their strategy.

“There has been a very noticeable uptick in the use of criminal elements to carry out terrorist attacks,” Schweitzer adds. “The guiding principle for countries that support and orchestrate terror attacks is maintaining plausible deniability.

“Because, notwithstanding all of its violations, it still operates within a set of international norms and wants to maintain a façade of decency. So, the most important part of the process is to maintain that deniability and using the criminal element adds another degree of separation. Another layer of protection. That allows Iran to claim that these assassinations are criminal in nature, not political.”

Former Mossad agents, who agreed to talk to Shomrim on condition of anonymity, also commented on the connection between Iranian terror and the criminal underworld. They also pointed out that the international trade in narcotics is a significant source of income for the Islamic Republic – as it is for Hezbollah in Lebanon.

“Our surveillance of the drug-smuggling trade as Hezbollah’s key economic lifeline reveals that the group is connected to all the (criminal) organizations, whether it’s in the Netherlands, Belgium, Sweden or Sri Lanka. There, they are on the same field as the big players,” one former Mossad agent told Shomrim.

At the same time, he added, “if they have, let’s say, a smuggling route to Paris which brings in $10 million a year, and they use that money to carry out a terror attack, then it’s gone. And still, this connection creates relationships and the possibility of getting to know and then recruit people who are not directly connected to the smuggling operation but are from the criminal underworld.”

According to American authorities, Zindashti and his network enjoy protection from the regime in Tehran and, in exchange, have carried out assassinations and kidnappings (some of which were foiled) for the Iranian Intelligence Ministry in the United Arab Emirates, the Netherlands, Turkey and even the United States.

Another similar case is that of Ramin Yektaparast, who, while not involved in trafficking narcotics, was a senior member of a German motorcycle gang and who German authorities suspected of murdering a member of a rival gang before fleeing to Iran.

A court in Dusseldorf found that Yektaparast was responsible for organizing a Molotov cocktail attack on a synagogue in Bochum and that he was probably also responsible for a shooting attack on another synagogue, this one in nearby Essen. Yektaparast was shot dead in Tehran early this year in an operation that has been attributed to the Mossad.

French authorities believe that the terror cell operating on their soil was headed by a major drug dealer from the Lyon area called Umit Bulbul, who, as far as they are aware, is currently in Iran. Bulbul, who was born in Pau in southwestern France, had two known aliases. One of these was Ilan Isaac Hadjaj, a French-born Jew. Another was a fictitious Turkish national called Harun Öztürk.

The cell’s operations were carried out by an Algerian-born French national known as Abdulkarim S., who was also known as Krimo. His full name cannot be published due to reporting restrictions in France. Krimo is well-known to French law-enforcement bodies, having served time for involvement in a gang warfare double murder in Marseilles and drug trafficking.

As part of Iran’s efforts to keep the various members of the network apart, Bulbul and Krimo were never in direct contact. Acting as their intermediary was Sedat (whose name cannot be published for similar reasons), who has a rich criminal record involving violence, theft, extortion and drug trafficking – and who is currently serving time in a French prison. It was almost natural that he would be selected as the go-between: he was one of Bulbul’s lieutenants in the gang’s narcotics enterprise and was a former cellmate of Krimo.

Krimo’s activation shows how the cell operated and what the Iranians were planning – including the fact that Tehran’s hit list included three senior members of the Jewish communities in Berlin and Munich. Although Krimo was barred from leaving France because of the conditions of his release from prison, acting on Iranian orders he traveled at least twice to Germany to collect intelligence on the targets.

On one occasion, he traveled to Munich by train, having purchased a ticket using his brother-in-law’s identification documents and not before remembering to turn off his cellphone before leaving French territory. When he reached his hotel, he used his phone with a local SIM card.

During his time in the city, Krimo visited the quiet neighborhoods of the Au-Haidhausen borough. Not exactly a hot tourist destination – but Krimo had other intentions. Au-Haidhausen is the location of businesses belonging to two of the intended assassination victims.

He walked past the premises several times, even entering the internal courtyard and taking videos and photographs of the surroundings, the entry door and the back and front entrances of adjacent buildings. He had no idea, of course, that he was being followed by undercover German intelligence agents the whole time.

Krimo spent a total of two days in Munich before returning to France. A week later, he once again boarded a train to Germany. When he alighted in Munich, on April 21st, he was stopped by local police and his documents were photographed. Even though he was under surveillance, this was actually a routine and random stop – but it concerned him. In a voice message he sent to an unknown recipient, he complained about the large police presence and returned to France two days later.

European authorities continued to surveil Krimo and members of his cell, but then something unexpected happened: German magazine Focus reported on the Mossad warning mentioned at the start of this article and added that a manhunt was underway for Krimo. Investigators were worried that he would flee and, the next day, he was arrested along with his wife, who was suspected of abetting him.

Under questioning, Krimo claimed that he had been working on behalf of a former cellmate, a young man of Turkish heritage called Emre, whose surname he never knew. He claimed that he met Emre in Lyon to get instructions and money from him – 1000 euros to take photographs of buildings in Germany. He said that Emra told him that the offices of companies that had defrauded a friend of his were located in these buildings. Although the story sounds far-fetched, it is not impossible that Krimo had no idea he was working for the Iranians.

Subsequently, according to Krimo’s testimony, Emre asked him to set fire to several buildings in southern France, explaining that it was for the purposes of insurance fraud. Krimo claimed that he had not carried out the arson attacks himself but had introduced Emre to other criminals. The buildings in question were torched in late November and early January and all were connected in some way to Israeli-owned companies.

By the time of the arson attacks, the cell’s operations were known to French security authorities. What remains unknown for the time being is whether members of the cell managed to go under the French radar to carry out these firebombings or whether authorities allowed them to do so in order to keep monitoring the cell, collect more intelligence and avoid revealing their sources.

Another unresolved question is whether “Emre” is a name that Krimo invented to shield Sedat and Bulbul from incrimination. When shown photographs of the two men, Krimo claimed he had never met them. However, there is evidence that suggests a connection. In November 2023, a seven-second phone call was made from a device used by Sedat to Krimo’s wife’s cell phone.

Furthermore, after Krimo and his wife were arrested, authorities searched Sedat’s prison cell and found a USB drive and three cell phones – at least one of which he had been using. That device contained Bulbul’s contact information in the Facebook Messenger app, while Krimo’s contact was saved in the Telegram app. During questioning, Krimo’s wife confirmed that she had heard him mention Sedat’s name. Krimo and his wife are currently awaiting trial in France.

The Prime Minister’s Office, which is responsible for the Mossad, issued the following statement: “Since October 7, there has been an increase in the threat level to Israelis and Jews across the world from terrorist organizations. Responsibility for protecting every Israeli citizen or Jewish person in a foreign country rests with the local intelligence, security and law-enforcement services. Intelligence agencies are constantly engaged in dialogue and cooperation to deal with threats.”

France’s General Directorate for Internal Security refused to answer questions on the issue and officials said that they are prohibited from discussing the case since legal proceedings are still underway.

The Iranian embassy in the Netherlands issued the following response: “Iran strictly abides by international law and respects the sovereignty of all states. Allegations that Iran is involved in directing or supporting attacks in Europe are unfounded and ridiculous. This is part of a campaign of deception aimed at damaging relations between Iran and European countries. It is unfortunate that such accusations are given credence, as their sole purpose is to sow division and mistrust.”

Attorneys representing Krimo said that “Mr. S. is currently the sole defendant (alongside his wife, whose involvement he denies) in a case whose severity is only becoming apparent to him when he is presented with the evidence. The failure to identify and/or arrest the assassins from the terrorist squad forces him to assume a role that is far too big for him.

“Mr. S. has been consistent during questioning. This shows, on the one hand, that he did not know the targets of the people who approached him and, on the other hand, that he bears no resentment whatsoever toward the Jewish community. There are no signs of radicalization or anything that could suggest that he is antisemitic. Nonetheless, he has been held in solitary confinement for more than three months.

“The severity of Mr. S.’s involvement is incalculably lower than the main players’, who are located above and below him in the criminal plan. Their arrest would allow him to return to his rightful position and allow him to be dealt with in accordance with his relative involvement in the affair.”

Attorneys for Krimo’s wife said that: “Our client knows nothing about the crimes she is alleged to have committed. She has no criminal past and is not known to the legal system. She has two children and is pregnant with a third and holds no radical views. These facts are not challenged but, nonetheless, she was incarcerated before her trial and countless requests for her release have been denied. She is likely to give birth to her third child behind bars.

“There is a terrible situation when it comes to cases classified as ‘terrorism’: individual freedoms and basic democratic principles such as the presumption of innocence are pushed aside in the name of ‘caution,’ which, in this case, is based on nothing but the security context of the case.”

Shomrim was unable to obtain responses from Sedat and Umit.

Get the Ynetnews app on your smartphone: