Criminal Proxies or Sleeper Cells: Who are the Islamic Republic’s Thugs in the West?

Iranwire – The London Metropolitan Police are continuing their investigation into the arson attack on four ambulances belonging to the Hatzola Northwest Trust charity in the Jewish neighborhood of Golders Green. While it is still unclear whether the act qualifies as terrorism, it is currently being treated as a hate crime.

The ambulances were deliberately set on fire on March 23. Around the same time, Canadian police began investigating a shooting at the U.S. Consulate and another at an Iranian sports club in Toronto. While these cases are still under investigation with no final conclusions, some observers have linked them to the Islamic Republic’s intelligence and sabotage activities. This has led to two competing theories: the use of “criminal proxies” by the Islamic Republic versus the activation of “security-sabotage sleeper cells.”

A “sleeper cell” is a familiar concept in security and espionage studies, commonly used in intelligence, counter-espionage, and counter-terrorism contexts. It refers to individuals who blend into everyday life within a country, sometimes for years, without any visible activity until they are instructed to carry out a mission.

Over the past 40 days, as the Islamic Republic has come under sustained pressure from Israeli and American forces, some experts believe the regime may have lost the capacity to carry out complex intelligence-led sabotage operations. Others argue that professional sleeper cells are typically not used for visible acts like shootings or crude sabotage, as they are trained for more discreet and strategic tasks.

Dan Stanton, a former executive manager in operations at the Canadian Security Intelligence Service (CSIS), explained Iran’s current approach:

“Regarding the style of Iranian intelligence activity, they do not use sleeper cells in the sense of deep-cover secret agents. Those agents are meant to operate quietly. They aren’t supposed to go and shoot at a consulate wall. Instead, they utilize what we call criminal proxies.”

Looking at these incidents, the key question remains: which theory is more convincing, the activation of “security-sabotage sleeper cells” or the use of “criminal proxies”?

Arson Attack on 4 Ambulances: Local Tension or Planned Sabotage?

On March 23, four ambulances belonging to the Hatzola Northwest Trust, a charity serving the Jewish community, were set on fire in Golders Green, North London. The Metropolitan Police have classified the incident as a hate crime.

According to British media reports, at least five individuals have been arrested in connection with the attack. Two have been identified as Hamza Iqbal (20) and Reihan Khan (19). A 17-year-old with dual citizenship was also detained, while the identities of the remaining suspects have not been officially disclosed.

Reuters reported that the attack created “terror and concern” within London’s Jewish community, with senior officials, including the British Prime Minister, calling it a “shocking anti-Semitic attack.”

Speculation about a possible link to the Islamic Republic and the IRGC increased after videos were released by a newly formed group calling itself “Harakat Ashab al-Yamin al-Islamiya.” The group does not have a formal website or a clear structure like Hezbollah and appears to operate mainly through Telegram channels.

Legal expert Omid Shams told IranWire that the group’s activities, which began in early 2026 across Liège, Amsterdam, and Rotterdam, could point to links with criminal networks based in the Netherlands.

“Given the concentration of this group’s activities in the Netherlands,” Shams said, “one hypothesis is a connection to criminal gangs, including drug traffickers. This might lead back to figures like Naji Sharifi Zindashti, an Iranian drug lord known to collaborate with IRGC Intelligence.”

Shams also pointed to a symbolic detail: the group used the well-known “Khorramshahr” musical piece by Majid Entezami in a video claiming responsibility for the London arson, a choice that suggests a possible IRGC connection. IranWire noted that it could not independently verify the video.

Not everyone agrees that the attack was state-driven. Babak Darbiki, a London-based political activist, told IranWire:

“While we know the Ministry of Intelligence and the IRGC plan sabotage, we cannot clearly attribute this to the IRGC when so many actions are driven by rising tensions between Jewish and Palestinian groups.”

However, parts of the British media have leaned toward the idea of state involvement. Daniel Boffey, a senior reporter for The Guardian, pointed to possible Iranian links in a report titled “Biker Gangs and Mercenaries: How Iran Increasingly Outsourced Its Terror Campaigns.” This reflects earlier reports suggesting the regime attempted to hire groups like the Hells Angels to target dissidents such as Masih Alinejad.

Larissa Brown, Defense Editor for The Times, also wrote on X (formerly Twitter) that Iranian intelligence may be recruiting individuals through social media, offering payments as low as £500 to carry out surveillance or attacks on British soil.

These patterns support the idea of “criminal proxies,” a method also referenced by Dan Stanton in relation to the recent shootings in Toronto.

Toronto Shootings: Where the Case for “Criminal Proxies” Gains Weight

During the same period, two shootings drew attention in Canada. On February 28, 2026, the gym of Salar Ghola, an Iranian-Canadian boxer and political activist supporting Reza Pahlavi, was hit by 17 bullets in Thornhill, Toronto. Another shooting took place on March 10, 2026, targeting the U.S. Consulate in Toronto. Canadian media outlets have connected these incidents, adding to suspicions of the Islamic Republic’s involvement.

Canada’s CBC was among the outlets that explored the possibility of the regime’s role, including the theory of “security-sabotage sleeper cells,” on its program The National.

Chris Leather, a senior commander with the Royal Canadian Mounted Police (RCMP) in Toronto, said in response to questions about security threats:

“I currently have no information regarding the presence or absence of sleeper cells in Canada. Suffice it to say that our counterparts across the country are actively investigating.”

Dan Stanton, speaking on the same program, offered a clearer view:

“Regarding Iran’s intelligence methods, they don’t use ‘sleeper cells’ in the sense of deep-cover secret agents. Those are meant to act quietly. They aren’t going to go out and shoot at a consulate wall. Instead, they use what we call criminal proxies.”

Broderick McDonald from Oxford University explained that Canada has largely avoided such attacks due to strong intelligence-sharing systems that detect threats early, and because the country has generally stayed away from “wars of choice.”

“This has been Canada’s stance, and I believe it has largely kept us safe from Iranian threats against the state and against civilians,” McDonald said.

The nature of these recent attacks, especially visible acts like shootings, suggests that instead of relying on trained sleeper agents, the regime may be turning to hired criminals to carry out such operations, making the case for “criminal proxies” stronger than that for traditional espionage cells.