Loading story…
Dutch authorities are investigating a possible Iranian role in the shooting of a 36-year-old Iranian activist in Schoonhoven who was critically injured outside his home. The victim, an ICT employee at the police, had publicly criticized Tehran, supported Reza Pahlavi, and shared online advice and intelligence-related requests with activists in Iran. Justice Minister David van Weel said investigators are seriously considering Iranian involvement, and the case has intensified concerns among dissidents in the Netherlands after earlier suspected Iranian-linked operations, including the 2024 attempted killing of activist Siamak Tahmasbi in Haarlem and previous cases in Almere and The Hague.
A separate assessment by the International Centre for Counter-Terrorism said recent firebomb attacks on Jewish targets and a U.S. bank in the Netherlands and Belgium were most likely conducted on behalf of the Iranian regime. The report said the attackers were likely recruited locally from youths on the margins of criminal gangs, while digital traces and online claims by the previously unknown group Harakat Ashab al-Yamin al-Islamia pointed to links with Telegram accounts associated with pro-Iranian militias in Iraq, including Liwa Zulfiqar. Dutch police are also examining terrorist motives after two boys, aged 14 and 17, were arrested in Heemstede over a suspected plot involving heavy fireworks, with a nearby synagogue considered a possible target; after a 14 March attack on a Jewish school in Amsterdam, the city raised security at Jewish sites to the highest level.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
An arson attack at Machzike Hadath Synagogue in Golders Green, London, burned four Hatzola ambulances. The Metropolitan Police said it was being investigated as an antisemitic hate crime with counter-terrorism involvement, while a group calling itself Harakat Ashab al-Yamin al-Islamiya claimed responsibility.
The International Centre for Counter-Terrorism assessed that recent firebomb attacks against Jewish targets and a U.S. bank in the Netherlands and Belgium were most likely carried out on behalf of the Iranian regime. The report pointed to online claim activity and digital links between the group Harakat Ashab al-Yamin al-Islamia and pro-Iranian militia networks in Iraq.
Dutch authorities arrested two boys, aged 14 and 17, in Heemstede on suspicion of preparing an attack using heavy fireworks. Investigators are examining possible terrorist motives, and a nearby synagogue was considered a potential target.
A 36-year-old Iranian activist and police ICT employee was shot outside his home in Schoonhoven and left critically injured. Dutch authorities said they were seriously considering a possible Iranian role because of his activism against the regime.
After the 14 March attack on the Jewish school, Amsterdam increased security for Jewish locations to the highest level. The move reflected concern over further attacks on Jewish targets.
A Jewish school in Amsterdam was attacked on 14 March, one of several recent attacks on Jewish and U.S.-linked targets in the Netherlands and Belgium. The incident was later assessed by ICCT as likely part of an Iranian-directed operation.
In 2024, Iranian activist Siamak Tahmasbi was the target of an attempted killing in Haarlem. The case was referenced as another suspected attack on an Iranian dissident in the Netherlands.
Earlier cases in Almere and The Hague were cited as incidents that Dutch authorities had previously connected to Iran, forming part of a broader pattern of suspected Iranian operations in the Netherlands. The article does not provide specific dates for these cases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
nos.nl
Open sourcemiddleeasteye.net
Open sourcenrc.nl
Open sourcenrc.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch media reported on several **separate national-security and information-integrity issues**, not a single incident. One report said Dutch police are seeing more so-called **"disposable spies"**: ordinary citizens allegedly recruited online by states such as **Russia** and **Iran** to conduct espionage or sabotage, including a case involving Dutch teenagers suspected of mapping Wi-Fi networks near sensitive institutions in The Hague. Another report examined renewed attention around **Havana syndrome**, noting persistent claims of anomalous health incidents among diplomats and intelligence personnel but emphasizing that experts still see little conclusive evidence for a practical directed-energy weapon causing lasting neurological damage. A separate NRC investigation found that former media executive **Peter Vandermeersch** published **fabricated or untraceable quotations** in multiple blog posts written in his fellowship role at Mediahuis, with dozens of quotes reportedly unsupported by the cited sources and several attributed speakers denying they made the statements. Another Dutch political report covered a **parliamentary motion** calling for a ban on the **Muslim Brotherhood** and affiliated organizations in the Netherlands, citing concerns about infiltration and foreign influence, while also noting that the group is not highlighted in the latest Dutch terrorism threat assessment. Because the references cover distinct topics spanning journalism, espionage, disputed weapons claims, and domestic politics, they should not be treated as one coherent cybersecurity event.
Jul 12, 2026
Iran-attributed cyber activity increased alongside escalating Middle East hostilities, with researchers reporting intensified targeting of internet-connected **IP cameras** across **Israel, Qatar, Bahrain, Kuwait, the UAE, Cyprus**, and later specific areas in **Lebanon**. Check Point assessed the activity as consistent with Iranian doctrine of leveraging compromised cameras for operational support and *battle damage assessment (BDA)* tied to missile operations, noting that tracking camera-targeting infrastructure may provide early warning of potential follow-on kinetic activity. Separately, Radware reported **149 Iran-linked DDoS attacks** observed between **Feb 28 and Mar 2**, largely aimed at **government entities in the Middle East**, and attributed most activity to three hacktivist groups: **Keymous+**, **DieNet**, and **Conquerors Electronic Army**. Additional OSINT-driven infrastructure analysis described broader Iranian state-aligned clustering using indicators such as **ASN patterns** and **TLS fingerprints** to map suspected operational infrastructure, while commentary from industry sources emphasized that **destructive “wiper” malware** remains a key concern (citing families including **ZeroCleare**, **Meteor**, **Dustman**, **DEADWOOD**, and **Apostle**). A separate ransomware “monthly state” roundup and a detection-engineering newsletter were not specific to this Iran/Middle East activity and do not materially support the incident reporting.
Jun 29, 2026
The FBI warned that hackers linked to Iran’s Ministry of Intelligence and Security (MOIS) are using Telegram as command-and-control infrastructure in malware campaigns targeting Iranian dissidents, journalists, and opposition groups worldwide. The activity, observed since late 2023, relies on social engineering in which attackers impersonate trusted contacts or tech support and deliver malware disguised as legitimate apps such as Telegram, WhatsApp, or KeePass. Once installed on Windows systems, the multi-stage malware establishes persistence and connects to Telegram bots, allowing operators to steal files, capture screenshots and audio, record Zoom calls, compress data, and exfiltrate information. U.S. authorities said the operations appear tailored to victims’ behavior, suggesting prior reconnaissance, and tied the activity to broader MOIS influence and disruption efforts. The FBI said the same ecosystem includes the fake hacktivist brands **Handala Hack** and **Homeland Justice**, which it linked to hack-and-leak operations that combine APT-style intrusions with disinformation and selective data leaks to cause reputational and political harm. The Justice Department has separately described Handala as an MOIS front involved in the recent Stryker attack, while the FBI has seized websites associated with Handala and Homeland Justice.
Jun 29, 2026