Iran hires European criminals to work as spies via Telegram bots
Tehran-linked channels advertise paid assignments for surveillance and other tasks, raising concerns about a growing 'gig-economy' espionage model across Europe
Iran is recruiting a network of “gig-economy” spies across Europe through Telegram channels offering cash payments for surveillance and other tasks, UK security sources warn.
Using encrypted messaging apps and cash incentives, Iranian intelligence is seeking to enlist people from across the continent to carry out surveillance operations and potentially violent attacks, including assassinations, The i Paper can reveal.
Channels on the messaging platform Telegram openly advertise “jobs” with Iran’s intelligence agency in a recruitment drive mirroring techniques used by Russian intelligence. The methods have raised concerns among counterterrorism officials that Tehran is increasingly outsourcing espionage and hostile operations to loosely connected proxies and criminals.
“They will literally hire anyone to commit arson, criminal damage, assault,” a Whitehall counter-terror source said, noting a “trend” whereby “professional criminals are recruited for the more sophisticated operations”.
One channel on the platform, which security officials believe is linked to Iranian intelligence, uses an automated Telegram bot to invite users to “work with Iranian intelligence in a tested, safe environment”.
Posts from the bot claim Tehran’s intelligence agencies recruit operatives “from all over the world regardless of incentives”. Another message urges members to “join us” and not “let your hidden talents and abilities go to waste”.
Western security officials say the overt and deliberate language represents a step-change in Tehran’s approach to recruitment, highlighting the increasing tensions between the UK and Iran as conflict in the Middle East intensifies.
According to a UK intelligence source, the recruitment model frequently involves individuals being hired for simple assignments, such as taking a photograph of a sensitive site or building.
In some cases, the intermediary who accepts the job may then recruit others, often local low-level criminals, to help complete the task for cash.
“It’s not all willing accomplices,” the UK intelligence source added. “It can also be naive individuals or pure criminality… unemployed and vulnerable people but also random criminals identified through illegal online marketplaces.”
In response to The i Paper’s findings, former home secretary Dame Priti Patel urged the Government to put considerable resources into tackling the growing threat from Tehran.
“Britain has world-class intelligence and security services who conduct offensive operations in order to protect our homeland security,” she said. “Now is the time for the Government to ensure they are putting in the essential leadership and resources to take down every Iranian threat to British citizens and to the security of our country.”
Tactics from the Kremlin’s playbook
The strategy reflects what security analysts call a “grey-zone” approach to operations designed to harass or intimidate opponents while preserving an arm’s-length deniability.
Similar techniques have been used by Russian intelligence in the recruitment of proxies to carry out sabotage attacks in the UK. During a four-week trial at the Old Bailey, the jury heard how a county lines drug dealer, Dylan Earl, was radicalised by a stream of pro-Kremlin propaganda on Telegram.
A group of young British men have been found guilty of working for state-backed Russian mercenaries to start a fire at an industrial estate in Leyton, east London, in March 2024 (Photo: LFB)
He began talking to people claiming to represent Wagner operatives using an account called “Privet Bot” and soon conjured up a plan to set fire to units at Cromwell Industrial Estate in Leyton, east London – destroying around £100,000 worth of humanitarian aid destined for Ukraine.
The latest revelations come amid increased concern that Moscow and Tehran are sharing intelligence and military equipment in their fight against the West.
Spies for hire
One of the clearest examples came in 2023, when Magomed-Husejn Dovtaev, an Austrian national, was convicted of spying for Tehran after carrying out surveillance on the west London headquarters of the Farsi-language TV network Iran International.
The reconnaissance was part of a wider plot by others to stage a terrorist attack against the broadcaster – a frequent target of threats from Tehran.
Roger Macmillan, who served as the network’s head of security at the time, said the case illustrated how easily Tehran can recruit operatives across Europe.
“The Iranians will pay anybody,” he said. “They just don’t care”.
Macmillan said gig-economy recruitment is “important” for the Iranians because they “can’t afford to have networks of people”, instead hiring would-be spies with no “degree of sophistication” about them.
Asked why he had taken photos of Iran International’s offices, Dovtaev told the Old Bailey he “quite simply liked it” and was “in wonder at the architecture”. He was found guilty of one charge of attempting to collect information useful for terrorism and sentenced to three years and six months in prison.
Crackdown on Iranian intelligence
The targeting of journalists and dissidents critical of the regime has been a consistent feature of Iran’s overseas operations. But there are fears that these groups will now be repurposed for an attack on British soil in retaliation for Donald Trump’s military strikes on Iran. In the past week British intelligence has increased its monitoring of known Iranian sleeper cells and proxy groups in the UK, this paper previously revealed.
On Friday, four men were arrested in north London and Hertfordshire on suspicion of working for Iranian intelligence in a plot to surveil and monitor individuals and sites linked to the Jewish community.
Police enter a property in Watford, believed to be linked to four arrests made on suspicion of spying for Iran (Photo: Jamie Lashmar/PA)
The arrests were part of a months-long counter-terror investigation, which also saw six other men in north London arrested for assisting the suspects. Detectives investigating the case have been granted more time to question the individuals as part of a probe into the suspected Iranian spy cell.
Following the arrests, Sir Keir Starmer said: “Our world-leading security services will not hesitate to protect you.
“There are some who will use moments like this to divide people. It is vital that we now come together as a nation, united in our common purpose.”
Iranian plots overseas took a further dent this week after Yahya Hosseini Panjaki, an Iranian intelligence officer accused by US authorities of directing global assassination plots, was killed during Trump’s strikes on Tehran.
A Foreign Office source told The i Paper that Panjaki acted as a bridge between Iran’s Ministry of Intelligence and Security and the powerful Islamic Revolutionary Guard Corps and was “very involved” in spy plots overseas.
Despite Panjaki’s death, the Whitehall counter-terror source said there would be “three layers of succession” ready to step into his place, and warned that the broader networks he helped build remain active.
In response to US strikes on the country, Iran’s online propaganda linked on recruitment channels has intensified. In recent days, posts have circulated showing videos and satellite images that Iran-linked channels claim show strikes on Western targets, including the UK’s RAF base in Cyprus.
Your next read
The messaging is, according to security officials, part of Tehran’s ambition to spread propaganda amongst supportive members of the regime.
“Sending the message about reach is part of the goal,” said a UK counter-terror source. “It’s about creating uncertainty.”
The result is a new kind of covert network, less like a traditional spy ring and more like a clandestine gig economy. For Western intelligence agencies, the methods present a growing challenge of hostile nations’ attempts to project power and recruit abroad without deploying their own operatives.
Telegram was approached for comment. A representative from the firm previously stated that content promoting criminal activity violates the platform’s terms of service and is removed upon detection.
In ShortQuick Stories. Same trusted journalism.
Comments (0)