OPEN LETTER: To the IRGC — Your Mediterranean Spy Network Has Just Been Dismantled

OPEN LETTER: To the IRGC — Your Mediterranean Spy Network Has Just Been Dismantled

Introduction: Athens convicts, London extradites, the Mediterranean under Iranian surveillance

A Greek court dismantles an IRGC network

To you, the officers of the Islamic Revolutionary Guard Corps who believed you could operate with impunity in the Eastern Mediterranean — on May 20, 2026, an Athenian court convicted an Azerbaijani national to seven years and one month in prison for espionage on behalf of Iran at the Souda Bay naval base in Crete. This base is one of the most strategically important military installations NATO has in the Mediterranean. You had an agent there, transmitting information about allied warships and American and European facilities. That is no longer the case.

A few weeks later, in June 2026, the United Kingdom formally requested the extradition of another suspect arrested in 2025 in Limassol (Cyprus), just 10 kilometers from the British base of RAF Akrotiri. This suspect is accused of espionage against British interests. The clandestine operations of the IRGC targeting NATO military installations and Israeli interests in the Eastern Mediterranean between 2025 and 2026 — a coordinated, methodical attempt that underestimated the vigilance of allied counter-intelligence services.

What this dismantlement reveals

This open letter is not a rhetorical exercise. It is an attempt to clearly name what your operations represent: a deliberate act of aggression against NATO allies and Israeli interests, conducted in the Mediterranean waters that lie at the heart of Euro-Atlantic security. These operations are not legitimate defense of Iranian interests — they are attacks against sovereign member states of a defensive alliance.

The arrests in Cyprus and Greece, the convictions in Athens, the British extradition request — all of this says that your operations in the Eastern Mediterranean are known, monitored, and being prosecuted. The message is clear: every agent you deploy in this region now risks being arrested, tried, and imprisoned.

Souda Bay, Akrotiri — targets of major strategic importance

Why these bases are priority targets for Tehran

Souda Bay naval base in Crete is one of the most strategically significant deep-water ports in the Eastern Mediterranean. It regularly hosts American and NATO warships, plays a key logistical role in allied naval operations, and monitors maritime movements across a geopolitically sensitive zone. For the IRGC, having an agent at Souda Bay theoretically allowed it to know the deployments and rotations of allied naval forces — information of priceless value for planning operations in the region.

RAF Akrotiri in Cyprus has a different but equally strategic importance. It is an advanced air base that has been used for operations against the Islamic State in Syria and Iraq, and that monitors a vast stretch of the Eastern Mediterranean. Its geographic proximity to Lebanon, Israel, Syria, and Turkey makes it a first-tier strategic observation post. Having an agent in Limassol, 10 km from this base, represented an intelligence collection opportunity the IRGC could not ignore.

The choice of Cyprus and Crete as operational terrain

The selection of Cyprus and Crete as operational terrain is not accidental. Both islands are open tourist economies with large expatriate communities and significant foreign populations. They offer plausible covers for operational agents. Their geographic position — at the heart of the Eastern Mediterranean, at the crossroads of Europe, the Middle East, and North Africa — makes them natural bases for monitoring military movements across the entire region.

These operations targeting Cyprus and Greece also reflect the IRGC's regional strategy: maintaining an intelligence presence in countries with economic and diplomatic ties to Iran, while targeting the NATO installations nearby. The Eastern Mediterranean is for Tehran a space where its geopolitical interests — through Hezbollah in Lebanon, a military presence in Syria — directly confront the security interests of Western democracies.

The Azerbaijani at Souda Bay — profile of an IRGC-recruited agent

The choice of an Azerbaijani national as an agent

The IRGC's recruitment of an Azerbaijani national for its operations in Greece deserves analysis. Azerbaijan, a majority-Shia country sharing a 756 km border with Iran, is a known IRGC recruitment terrain. The Azerbaijani-speaking population of northwestern Iran — several million people — offers a potential recruitment pool, and Iranian services have historically sought to operate among diaspora Azerbaijani communities.

Using an Azerbaijani national — whose nationality is not immediately associated with Iran — as an agent in Greece is a classic intelligence service cover technique. This approach aims to create a deniability distance between the operation and Tehran. But Greek services and their partners obviously have the capacity to reconstruct the command and financing chains linking a field agent to the state behind it.

IRGC recruitment networks in Europe

The IRGC maintains active recruitment networks across several European countries, targeting in particular members of Iranian diaspora communities, nationals of countries with historical ties to Iran (Iraq, Lebanon, Afghanistan, Azerbaijan), and people with family remaining in Iran who are susceptible to pressure. These recruitments combine ideological persuasion, financial motivation, and coercion.

European counter-intelligence services have documented the intensification of these recruitment activities since 2022, in parallel with the escalation of tensions between Iran and the United States and Israel. The Cyprus and Greece cases illustrate that these recruitments have concrete operational applications — not merely dormant networks, but active agents gathering information on military targets.

The British extradition request: the chain of responsibility

Limassol, 10 km from Akrotiri — an operation too close

The arrest in 2025 in Limassol of a suspect for espionage against British interests, and the United Kingdom's formal extradition request in June 2026, illustrate a particularly audacious IRGC operation. Limassol is a Cypriot city barely 10 km from a sovereign British military base — British territory legally outside the jurisdiction of the Republic of Cyprus. Positioning an agent at that distance from such an installation means accepting a high risk of detection.

The British extradition request sends a clear signal: London wants to try this agent in its own courts, under its own national security legislation. This is an assertion of sovereignty and jurisdiction — and an implicit declaration that protection of British overseas bases is a national priority that His Majesty's counter-intelligence services take seriously, regardless of geographic distance.

Greek-British judicial cooperation as a model

This case illustrates effective judicial and intelligence cooperation between Greece, Cyprus, and the United Kingdom. The arrests were made possible because counter-intelligence services shared information on IRGC networks in the region. The Athens conviction and the British extradition request together constitute a comprehensive dossier against Iranian operations in the region.

This model of cooperation — early intelligence sharing, coordination of arrests, judicial follow-through in multiple jurisdictions — is precisely what Europe must systematize in the face of the proliferating operations of hostile services on its territory. Successful cases like this one must become case studies for other European services and jurisdictions.

The IRGC's Mediterranean strategy: targets and methods

Israeli interests as the primary target

IRGC operations in the Eastern Mediterranean prioritize Israeli interests. Ports welcoming Israeli vessels, Israeli businesses established in the region, personnel linked to Israeli security — all constitute collection targets and potential action targets for the IRGC. Cyprus and Greece, both of which maintain relations with Israel (though nuanced in Greece's case), are ideal platforms for monitoring these interests.

Iranian operations against Israeli targets in Europe are not new. Attempted assassinations of Israeli diplomats and nationals in Europe have been documented over several years, and several suspects linked to the IRGC have been arrested in Germany, Austria, and Belgium. The Eastern Mediterranean is simply a particularly active theater of this covert war.

NATO targets: a troubling escalation

What is newer — and more troubling — in the Cyprus and Greece cases is the direct targeting of NATO installations. The intelligence collected at Souda Bay did not concern only Israeli interests — it concerned allied naval forces, rotations of American warships, and power projection capabilities in the Mediterranean. This is a level of operational ambition that goes beyond the IRGC's classic anti-Israeli operations.

This escalation toward NATO targets can be explained by the intensification of tensions between Iran and the United States in the months preceding the Geneva accord. In a context of direct conflict risk, the IRGC had heightened interest in knowing the capabilities and positions of American forces deployed in the region. This information could have been used to plan reprisals or to assess the risk of additional American strikes.

Operational lessons for European security

Reinforcing security perimeters around NATO Mediterranean bases

The Cyprus and Greece cases impose a revision of security perimeters around all NATO and British bases in the Eastern Mediterranean. This is not merely a matter of physical security — it requires systematic surveillance of persons residing in the immediate vicinity of these installations, particularly when they have links to countries whose intelligence services actively target allied interests. This surveillance must be coordinated between the host services — Greek, Cypriot — and the services of the countries whose forces are stationed at these bases.

The Athens conviction proves that such surveillance is effective when well conducted. Greek services detected, tracked, and assembled a dossier solid enough to obtain a conviction. This work deserves to be documented, analyzed, and systematized — not merely congratulated. Every NATO member state with forces stationed in the region must be able to build on this model to improve its own security procedures.

Education of diaspora communities as a protective tool

One of the most effective responses to IRGC recruitment operations in Europe runs through the communities themselves. European counter-intelligence services have an interest in working with Iranian diaspora communities — the vast majority of whom oppose the regime — to identify and report unusual approaches. These communities are both the IRGC's preferred recruitment targets and its most motivated adversaries.

Discreet education programs, run in partnership with recognized Iranian community organizations, could help raise awareness among persons likely to be approached by the IRGC. Knowing how to recognize an intelligence service's recruitment techniques, knowing the channels for reporting an approach, understanding the legal protections available — these are concrete tools that can save lives and prevent operations.

NATO and EU response to the Iranian threat

European sanctions and their insufficiency

The European Union has adopted targeted sanctions against the IRGC and its leadership in the context of the repression of the "Woman, Life, Freedom" movement in Iran since 2022. These sanctions are symbolically important but have limited reach against the IRGC's intelligence operations in Europe. The IRGC officers who plan operations in the Eastern Mediterranean probably do not travel under their real names and do not hold European assets liable to be frozen.

A more effective response involves active counter-intelligence measures — heightened surveillance of persons identified as linked to the IRGC, expulsion of Iranian diplomats identified as cover agents, reinforcement of security procedures around sensitive military installations in Mediterranean countries. These measures are less politically visible than sanctions, but far more operationally effective.

Kubilius's warning and its implications for the Iranian threat

European Defense Commissioner Andrius Kubilius warned in June 2026 that Europe must prepare for more attacks. While his comments primarily targeted Russian hybrid operations, the logic applies equally to the Iranian threat. The Athens conviction and British extradition requests confirm that the IRGC operates actively in Europe — not only in the Middle East.

This reality should be integrated into threat assessments of all EU and NATO member states. Post-Geneva-accord Iran is not an Iran that has abandoned its regional ambitions or its foreign intelligence operations. It is an Iran that negotiates with one hand and maintains its capabilities with the other.

The Athens judicial precedent and its implications for Europe

A conviction that sets a precedent

The seven years and one month sentence handed down by the Athens court in May 2026 establishes an important judicial precedent in the fight against Iranian espionage in Europe. This is not a case buried as a sordid incident or reduced to a minor matter — it is a firm, public conviction for espionage on behalf of a foreign state targeting NATO bases. This judicial publicity is in itself a dissuasive message that allied services should systematically amplify.

Other European countries facing similar IRGC operations — Germany, France, Austria, Belgium — can build on this Greek precedent to harden their own judicial procedures. IRGC operations in Europe are not local anomalies — they are part of a coherent global strategy that every democracy must address with equal firmness.

What Europe must do after the Athens and Nicosia arrests

The European Union must draw from these cases a practical and urgent lesson: the information-sharing mechanisms between member states' counter-intelligence services are not yet equal to the threat. Rapid protocols are needed to alert partners when an IRGC network is discovered, so that other branches of the same network in other countries can be detected and neutralized before they are tipped off by the arrest in Greece or Cyprus.

This is a question of speed and coordination. Allied services perform well individually — the cases prove it. But the IRGC itself operates in a coordinated manner across borders. The European response must match that coordination to be effective. The European Counter-Intelligence Center proposed by some analysts is no longer a conceptual luxury — it is an operational necessity.

Conclusion: the Mediterranean, theater of a permanent secret war

The message to counter-intelligence services

The conviction in Athens and the extradition request in Nicosia demonstrate that Greek, Cypriot, and British counter-intelligence services are doing their job. These judicial results are the fruit of patient, discreet, and often thankless work. They deserve recognition and support through budgets and staffing commensurate with the threat.

The Eastern Mediterranean is a strategic space where the security interests of Western democracies confront directly the geopolitical ambitions of Iran and, indirectly, of Russia (through its presence in Syria) and China (through its port investments). Maintaining security in this region demands a permanent, coordinated, and effective counter-intelligence presence — exactly what the 2026 cases have demonstrated.

To the IRGC, a final word

To close this open letter with the clarity the situation demands: your operations in the Eastern Mediterranean have been identified, documented, and sanctioned by the judicial systems of the countries you were targeting. The next operation you launch will be watched from its inception. The bases of Souda Bay and Akrotiri are protected by counter-intelligence services that know your methods, your networks, and your targets.

Your officers who deploy agents 10 km from a sovereign British base or at Souda Bay must know they are sending those men toward courtrooms — not toward operational success. The bill for your Mediterranean ambitions is beginning to be presented. It will continue to be.

By Maxime Marquette, columnist

Columnist's transparency note

My sources and their limits

This open letter rests on publicly available information about Iranian espionage cases in Greece and Cyprus, cited in Wikipedia (entry: IRGC espionage network in Cyprus and Greece), BBC reports, and analyses from AsymIntel and El País on the expansion of Iranian espionage networks. I do not have access to court documents, or classified files from Greek, Cypriot, or British counter-intelligence services. The factual elements presented as certain — the conviction date, the sentence, the 10 km distance between Limassol and Akrotiri — come from public sources.

The open letter format is a rhetorical choice that allows directly naming responsibilities. It does not mean I have access to confidential information about the IRGC or that my operational analyses are verified by intelligence sources. These are analyses based on public information.

My declared biases

I consider the IRGC a destabilizing organization, responsible for state terrorism, assassination of dissidents, and espionage against democracies. I support firm counter-intelligence measures against its operations in Europe. These positions are acknowledged. I nevertheless distinguish between the regime's operations and the millions of ordinary Iranians who have no connection to the IRGC and who themselves suffer its abuses.

What I do not know: the full identity of the suspects, the precise operational details of the dismantled networks, and whether other IRGC operations remain active in the region at the time of writing.

Sources

Primary sources

Wikipedia — IRGC espionage network in Cyprus and Greece — updated 2026

BBC — Iranian espionage in Europe: the Cyprus case — 2026

AsymIntel — Weekly brief: conflict escalation — June 7, 2026

Secondary sources

Le Monde — Russia's shadow over French soil — June 20, 2026

El País — China expands its spy networks across the EU — June 7, 2026

Euronews — Kubilius: Europe should prepare for more attacks — June 23, 2026