This story was co-published with Foreign Policy.
After a decade in which al Qaeda dominated the world stage, the global terror threat from Iran has escalated sharply, generating a swarm of recent plots from Delhi to Mombasa to Washington and signaling an aggressive new strategy, counterterror officials say.
But there were meager results until this month. On July 18, a suspected suicide bomber killed six people and wounded 30 aboard an Israeli tourist bus in a coastal town in Bulgaria. Israel quickly accused Hezbollah and Iran, longtime sponsor of the Lebanese Shiite militant group. Many questions remain about the bombing, and Bulgarian authorities have said they do not have proof implicating Hezbollah so far. Nonetheless, many Western counterterror officials share Israel's suspicions.
If the allegations are true, Iran and Hezbollah have crossed a dangerous line with their first strike in Europe in more than 15 years. The repercussions are stoking more turmoil in a Middle East torn by civil war in Syria and conflict over Iran's nuclear ambitions.
ProPublica has reviewed a string of plots attributed to the Shiite alliance, 10 cases in the past year alone, and found a complex and contradictory evolution of the threat. Iran and Hezbollah have waged a determined campaign to strike their enemies in retaliation for attacks on the Iranian nuclear program and the killing of a Hezbollah chief, counterterror officials say. The offensive led by the Quds Force, Iran's elite foreign operations unit, has displayed impressive reach and devastating potential.
"The Hezbollah-Quds force threat is the big thing worldwide right now," a U.S. counterterror official said. "There has been a wave of activity."
Yet the modus operandi so far has veered between agility and clumsiness, precision and improvisation. Most of the attempted strikes have failed, often hampered by hasty execution and unreliable operatives, according to counterterror officials and experts around the world. In some ways the apparent opportunism and erratic behavior make the menace worse, increasing the chances of conflict with the West, experts say.
"These cases all seem amateurish," an Indian counterterror official said. "The Iranians feel great frustration and desperation because of the attacks on the nuclear program, a real desire to strike. So they aren't prepared — they act quickly. They don't care about reprisals. They are out of practice. They have done few operations like this since the '90s."
ProPublica interviewed law enforcement, intelligence and diplomatic officials and experts from the United States, Europe, Israel and India for this article, granting them anonymity because of the ongoing investigation in Bulgaria and because many are not authorized to speak to the news media. They included officials from governments that do not always agree with Jerusalem and Washington about the nature of the Iran-Hezbollah threat.
Starting in the 1980s, Hezbollah and Iran conducted an international campaign of bombings, hijackings, kidnappings and assassinations against Israeli, U.S., European, Saudi and Iranian dissident targets.
In Argentina, car bombs blew up the Israeli embassy in 1992 and the AMIA Jewish community center in 1994, killing a total of 115 people. Argentine prosecutors charged that the Quds Force and Hezbollah used a web of diplomats, front companies and logistics specialists in the Lebanese diaspora.
Iran had "plots on the shelf methodically prepared and updated all over the world," said Charles (Sam) Faddis, a retired CIA counterterror chief. "They would do recon to test the defenses, update contingencies and plans."
In 2001, Deputy Secretary of State Richard Armitage called Hezbollah, which relies on Iran for funding, arms and support, "the A-team of terrorists." But the alliance scaled back international terror activity outside of combat zones such as Lebanon, Iraq and Afghanistan. Al Qaeda and its Sunni Muslim allies were the most urgent terror threat to the West during the past decade, but have declined dramatically in strength. Al Qaeda has not carried out a fatal bombing in the West since 2005.
In February, Iran allegedly tried to unleash a terror spectacular in the style of old, targeting three countries at once. A motorcycle bomber managed to wound an Israeli diplomat in India. But authorities foiled attacks in Georgia and Thailand — where a bomber blew off his own legs — even though a Quds Force commander had traveled undercover to Bangkok to lay the groundwork, according to Western counterterror officials.
Last year, Quds Force officers allegedly directed an Iranian-American used-car salesman to hire drug traffickers to assassinate the Saudi ambassador in Washington. But the suspect unknowingly recruited a U.S. Drug Enforcement Administration informant and was arrested; defense lawyers assert that their client has a mental disorder.
"It's as if there's a systematic policy of Iran recruiting low-rent, downright kooky terrorists," said British security expert Sajjan Gohel of the Asia-Pacific Foundation.
Another factor has played a role: In the aftermath of the 9/11 attacks, global defenses against terrorism have been beefed up. Still, Iranian spymasters have deployed seemingly inexperienced or ineffective agents, especially those with Western passports. The profile helps preserve deniability, according to Ali Alfoneh, an expert on the Iranian military at the American Enterprise Institute.
"They don't want to sacrifice better-equipped, better-trained people who, if arrested, can compromise the Quds Force, give up a lot of inside information," said the Iranian-born Alfoneh.
In Burgas, Details Trickle Out
The successful strike in Burgas, a low-cost beach resort popular with young Israelis and Scandinavians, took place on the 18th anniversary of the AMIA bombing in Argentina. According to news reports, Bulgaria's prime minister has described a sophisticated conspiracy by "exceptionally experienced" terrorists.
The scope was limited, however. And there were sloppy details.
The suspected bomber carried a fake driver's license from Michigan, which has a large population with Middle Eastern roots, according to U.S. and European officials. The forger put a Louisiana address on the license, an error that could have endangered the operation. A suspected accomplice carried another fake Michigan driver's license, this one with a Michigan address, U.S. law enforcement officials say. A travel agency refused to rent a car to the nervous suspected accomplice before the attack because the license raised suspicions, officials said.
The decision to hit Israeli tourists aboard a bus further reflects limitations, experts say.
"The attempts at attacking embassies and embassy personnel have been failures, so they are shifting to soft targets," Alfoneh said.
Bulgarian authorities say the bomber and the accomplice, who apparently remains at large, arrived by plane about a month earlier. The bomber is believed to have flown in via Germany and the accomplice via Belgium, according to U.S. and European officials. Police following circumstantial leads have questioned a third person, a man of Turkish descent, but have not linked him to the attack so far, a U.S. law enforcement official said.
The target, symbolic date and context of previous activity implicate Iran and Hezbollah, counterterror officials say.
"I am convinced the origin of this attack is Shiite," an Italian counterterror official said. "In the last two years, there was growing concern that they were going to come here to Europe to do something. They know if they do it in Israel, it's more difficult and retaliation is more likely."
Israel has not offered concrete proof to back up its repeated accusations. Hezbollah and Iran deny responsibility. Iran accused Israel of orchestrating the attack on its own citizens. The process of identifying the attackers has been slow and the fingerprints sent to European and U.S. agencies and Interpol have not produced a match, according to counterterror officials.
As a result, doubts endure. The apparent use of a suicide bomber perplexes some analysts. Iran and Hezbollah carried out major suicide attacks in the 1980s and early 1990s. The tactic then spread to Sunni groups. Al Qaeda began carrying out "martyrdom operations" in the mid-1990s and made them a signature. At the same time, Iran and Hezbollah have greatly curtailed the use of suicide bombers, counterterror officials said.
The backpack bomb itself is a point of contention. The U.S. law enforcement official said aspects of the device in Burgas resembled bombs in the suspected Iranian triple plot in February. But the TNT-based explosive differs from the Iranian-made plastic explosive in the February case, according to another U.S. law enforcement official, who remains skeptical.
"I'm not convinced it's Iran and Hezbollah," he said. "I'm waiting to see the evidence."
Complicating the issue, there has been no credible claim of responsibility. Al Qaeda usually follows attacks with videos featuring declarations by the suicide bombers, the network's leaders or both. Iran and Hezbollah keep silent.
"It creates more fear," the Italian counterterror official said. "Ambiguity suits them very well. The attack itself sends the message."
Whoever they were, the masterminds probably chose Bulgaria because it has weaker law enforcement and more porous borders than most of the European Union. Bulgaria has the EU's highest proportion of Muslims, about 12 percent of the population, though so far no public information has suggested a link to the local Islamic community. Hezbollah operatives have previously been detected in Bulgaria, U.S. law enforcement officials say.
Western intelligence officials warned of Bulgaria's potential as a theater for terror five years ago. Intelligence revealed that Hezbollah chiefs and Iranian intelligence officials had put Bulgaria on a list of nations propitious for developing plots against Western targets. Iranian spy agencies prefer developing countries, where it's easier to cover their tracks, experts say.
Conflict with Israel intensified in February 2008 after a car bomb in the heart of Damascus killed Imad Mughniyah, a notorious Hezbollah military leader and ally of Iranian intelligence. Iranian and Hezbollah leaders publicly accused Israel and vowed revenge.
Within weeks, a plot was under way against the Israeli embassy in Azerbaijan. Police broke up the cell in May 2008. The suspects included Azeri accomplices, a senior Hezbollah field operative and a Hezbollah explosives expert. Police also arrested two Iranian spies, but they were released within weeks because of pressure from Tehran, Western anti-terror officials say. The other suspects were convicted.
Police in Turkey soon broke up a similar plot against Israeli targets, arresting Hezbollah operatives with Canadian and Kuwaiti passports said to be involved in smuggling a car bomb across the border from Syria in 2009.
The close partnership between Iran and Hezbollah is not without friction. There is debate in the Western intelligence community about the extent to which Hezbollah would do Iran's bidding in event of a confrontation between Tehran and the West. But many cases show that Iran and Hezbollah work together on terror activity, Western counterterror officials say.
House Painter Turned Hit Man
Iranian dissidents also found themselves in the crosshairs, according to government documents and investigators.
In July 2009, police in Glendora, Calif., arrested an Iranian-American house painter when his accomplice got cold feet and reported that he was planning a murder.
The suspect, Mohammad Reza Sadeghnia of Ann Arbor, Mich., had done surveillance on a prominent Iranian dissident who hosted a Farsi radio show, according to a report by the Glendora police. Sadeghnia hired an accomplice, an Iranian immigrant with a criminal record, paying him $27,000 via his mother in Iran, the report says.
The two conspirators holed up in a seedy motel for five days, police say. After half-hearted efforts to buy a gun, Sadeghnia decided to make the killing look like a traffic accident, according to the police report. He and his accomplice purchased a 1986 van for $1,800. They tinkered with the engine in a plan to run over the dissident and blame a mechanical problem, the report says.
"He didn't strike me as the Jason Bourne of Iran," Capt. Tim Staab of the Glendora Police said in an interview.
Suspecting that his accomplice had lost his nerve, Sadeghnia threatened to have the man's relatives killed in Iran, according to the police report.
"I have done other missions around the world," Sadeghnia warned.
Alerted by the repentant accomplice, police rushed to a hotel near the Los Angeles airport and arrested Sadeghnia, who was headed to a strip club before catching a night flight to Detroit, according to Staab.
Sadeghnia was charged with conspiracy to commit murder and pleaded guilty to a lesser crime. He served about a year in prison and got five years more probation, authorities said. When a judge allowed Sadeghnia to visit his ailing father in Iran in 2010, he never came back.
Despite Sadeghnia's amateurish exploits, there are signs he was a bona fide agent. He had plenty of cash — crisp new bills in a seal from an Iranian bank, according to police. Sadeghnia admitted to the FBI that he was gathering intelligence on his target, the police report says.
Before the Los Angeles episode, Sadeghnia had allegedly conducted surveillance in London on another Iranian dissident, a radio commentator for Voice of America there, according to a U.S. State Department cable disclosed by WikiLeaks. Sadeghnia befriended the dissident, met with him in London and Washington, and took photos of him, his home and his car, according to the cable, dated Jan. 21, 2010. The dissident grew suspicious and cut off contact with Sadeghnia, the cable says.
After the arrest in Los Angeles, British authorities warned the radio personality that Sadeghnia had been "working for the Iranian intelligence services," according to the cable. It says that the London surveillance photos were provided to Majid Alavi, a deputy Iranian intelligence minister at the time.
Although the case reveals skullduggery in the heart of the West, the bumbling clashes with the formidable image of the Iranian security forces.
"Why have they been so unsuccessful?" said Alfoneh, the Iran military expert. "The Islamic Republic of Iran is a Third World country, contrary to what people believe. ... Experience has shown when they operate very far away, their success rate is not good."
$100,000 And Hit Men
In the past two years, Iran redoubled efforts to strike its enemies in response to attacks against its nuclear program, including a major cyber-assault and assassinations of nuclear scientists with sophisticated "sticky" bombs attached to cars. Iran blames Israel and the United States for those attacks.
The regime, under pressure to show strength at home and abroad, incorporated Hezbollah into its retaliatory offensive, experts say.
"The two organizations cooperate," Alfoneh said. "The motivation of Hezbollah is to deliver services in exchange for the arms and money they receive. The motive of Iran is to repair its damaged prestige, the image that it is not even capable of defending its scientists. This is why they did those ill-prepared attacks. They needed to produce something."
Last year's Washington plot had an opportunistic quality. U.S. prosecutors charged Manssor Arbabsiar, a naturalized U.S. citizen living in Texas, and Gholam Shakuri, a colonel in the Quds Force who is thought to be in Iran, with planning to assassinate the ambassador of Saudi Arabia, a nemesis of Tehran. There was also talk about Israeli targets, according to U.S. officials.
The evidence included a $100,000 wire transfer sent to Arbabsiar and telephone intercepts of senior Iranian officers discussing his plan to hire Mexican hit men for an ambush in a restaurant, according to a criminal complaint and U.S. officials. Separately, the U.S. Treasury Department accused three Quds Force chiefs as masterminds: Gen. Qasem Sulemaini, the Quds Force commander; Hamed Abdollahi; and Abdul Shalali, a cousin of the Iranian-American suspect.
Arbabsiar had little apparent training and few qualifications other than his family connection, according to U.S. officials. His business career and personal life were checkered, according to court documents and state records. In the spring of 2011, he enlisted a Mexican drug cartel associate because he knew the man's aunt, according to officials and a federal complaint. The cartel associate, a DEA informant, promptly alerted his handlers and set in motion an undercover sting led by the FBI.
Arbabsiar pleaded innocent and awaits trial in the fall. In expert reports filed recently in federal court in the Southern District of New York, his lawyers paint him as hapless. Two defense psychiatrists said he was bipolar.
"Arbabsiar consistently lost keys and titles to cars when he ran a used car lot," Dr. Michael B. First of Columbia University wrote in one report. Arbabsiar spent much of 2010 depressed and smoking cigarettes in his room, the report says. In manic episodes, the report says, he "becomes excessively energized, speaks rapidly, becomes hypersexual, is inappropriately trusting of other people to the point where he gets taken advantage of, and needs less sleep."
On one plane flight, Arbabsiar "decided to treat the stewardess, the pilot and passengers seated around him to expensive bottles of perfume from the duty-free cart because he wanted to make everyone feel good," according to the report.
To be sure, that portrait comes from defense lawyers. But the case has caused consternation in the U.S. intelligence community and some public skepticism. U.S. counterterror officials are convinced the evidence is solid, but they expressed surprise that Iran used a seemingly low-caliber agent for a high-risk scenario verging on an act of war.
The misadventure may reflect factionalism and freelancing in Iran's mafia-like security forces, according to experts and officials. Some theorize the Quds Force launched the mission mainly to send a warning message, or as part of Iranian political intrigue.
In the aftermath, the Director of National Intelligence, James Clapper, warned about a shift in Iranian strategy. "Some Iranian officials — probably including Supreme Leader Ali Khamenei — have changed their calculus and are now more willing to conduct an attack in the United States in response to real or perceived U.S. actions that threaten the regime," Clapper said during Senate testimony in January.
String of Recent Plots
The Arbabsiar arrest last October did not slow the drumbeat of terror activity.
Weeks later, an alleged plot was detected in Azerbaijan, this time aimed at Americans as well as Israelis, counter-terror officials say. The Washington Post detailed that case in a recent article.
Israeli leaders have said publicly that they warned Bulgaria in January about another suspected threat there against Israeli tourists on winter vacation.
In Thailand on Jan. 16, police discovered a warehouse containing 8,800 pounds of explosives material. They jailed a suspect accused of stockpiling the stash and distilling the materials into crystal form, a step toward bomb-making. A former hairdresser born in Lebanon, Hussein Atris holds a Swedish passport and is a suspected Hezbollah operative, according to counterterror officials.
More than a dozen embassies in Bangkok issued warnings about impending attacks after the arrest. Despite that alert, a Quds Force commander named Majid Alavi secretly entered Thailand on a high-stakes mission, according to Western counterterror officials.
Alavi is believed to be the same senior figure named in the WikiLeaks cable that described spying on dissidents in London and Los Angeles. He has served as Iran's acting intelligence minister, officials say. He shifted to the Quds Force early this year and along with Abdollahi, a commander accused in the Washington plot, now runs a team known as the Special External Operations Unit, or Unit 400, according to Western officials.
The unit "conducts sensitive covert operations abroad [that] include terrorist attacks, assassinations, kidnappings and sabotage," a U.S. official said. The unit has supported Iraqi militants, "provided weapons, equipment, training and money to Afghan insurgents ... and also arranges the delivery of lethal aid into Syria and Lebanon and military training for Hezbollah and Palestinian militants."
The Quds Force reports directly to Iran's Supreme Leader Khamenei, officials said, bypassing the Iranian military's complex decision-making structure.
Alavi traveled to Bangkok on Jan. 19 using a diplomatic passport with the alias Hossein Tehrani, according to Western counterterror officials. He is believed to have entered from Malaysia, a suspected hub of the triple plot, according to a European security source who was briefed by Thai officials.
The commander spent several days in Thailand working on preparations for an attack and meeting with Thai Shiite accomplices, officials said. Alavi relayed orders to strike as close as possible to Feb. 12, the anniversary of the Mughniyah killing, officials said.
"It is unusual for someone of his rank to take part at the operational level, but this is indicative of the pressure being applied from the most senior political-military levels of the regime to carry out attacks," a Western counterterror official said.
Other Iranian cells allegedly set up in Tbilisi, the capital of Georgia, and Delhi. A group of Iranians with tourist visas entered India, which has good relations with Tehran and a large Iranian student community. Their accused Indian accomplice is a freelance journalist: Mohammed Kazmi, a Shiite Muslim and frequent collaborator with Iran's national news agency. (Kazmi has pleaded not guilty and is being held for trial.)
Closed-circuit television footage, Kazmi's statements to investigators and other evidence show that he helped his visitors do reconnaissance on the Israeli embassy and helped provide them with a motorcycle, Indian authorities say. The suspects communicated with the Iranian embassy and handlers in Iran, Indian officials say.
The cells went into action Feb. 13, investigators say. A motorcyclist maneuvered through traffic in the heart of Delhi's embassy district, slapped a magnetic bomb onto an Israeli diplomatic vehicle and sped away. The explosion wounded the wife of Israel's defense attaché. The method used closely resembled the assassinations of Iranian nuclear scientists. The Iranian suspects fled the country, with the bomber heading to Malaysia.
Other plots fizzled. A bomb placed on an Israeli embassy car in Georgia was detected. And in Bangkok, a wild scene took place at a safe house when a bomb exploded prematurely, causing three suspects to flee, according to the account of U.S., Israeli and European officials.
Sayed Moradi was wounded in the Bangkok blast, according to the officials. He staggered into the street, bleeding from the ears, and tried and failed to escape in a taxi. When police closed in, he hurled a grenade at them that bounced back and blew off his legs. Police arrested him and two other Iranians. A fourth fled to Malaysia, where he was captured.
The cells in the three countries were linked by telephone contact, according to officials. And the sticky bombs resembled each other, according to counterterror officials from several countries involved. The devices were encased in shoebox-sized radios with components including a grenade, Iranian-made plastic explosives and magnets on the bottom, officials said.
In the aftermath, Thai press reports and photos revealed that the suspects in Bangkok took time from casing Israeli diplomatic targets to cavort with prostitutes. An ambitious plan to spread worldwide terror broke down because of questionable personnel and "improvised" plots, a French official said.
"Iran wanted to strike fast and strong," the French official said. "But they weren't ready. It was intended to send a signal. They failed."
Surveillance on Israeli Tourists
New incidents raised concerns in the weeks before the Bulgaria blast.
In June, the U.S. embassy in Nairobi issued a terror warning after Kenyan police arrested two alleged Quds Force officers and found 33 pounds of explosives in a shipping container in the port city of Mombasa. Authorities allege that they had Israeli, U.S. and Saudi targets in mind. The Iranian suspects have denied guilt and face trial.
An arrest took place in Cyprus on July 7. Police detained a suspected Hezbollah operative and charged him with conducting surveillance on Israeli tourists, who frequent the island in large numbers.
As in Thailand in January, the suspect held a passport from Sweden, which has an active, internationally connected community of extremists. He remains in jail. His profile fits a pattern of using operatives with Western documents.
Israeli leaders say the Cyprus case has close parallels to the bombing in Bulgaria 11 days later. If the investigation implicates Hezbollah and Iran, it could worsen the Middle East turmoil caused by the civil war in Syria.
While vowing a stern response to the bombing, Israel has also warned that it might intervene militarily if Syria attempts to transfer chemical weapons to its allies. Iran and Hezbollah have a vital triangular alliance with Syria, which plays a central role helping Iran fund, train and arm the Shiite militant group. The Syrian crisis has pushed Tehran and Hezbollah closer together, though Hezbollah Secretary General Hassan Nasrallah knows that supporting the regime in Damascus hurts his international image, experts say.
"When the individual interests of Hezbollah and Iran coincide, they are more dangerous," said Matthew Levitt of the Washington Institute on Near East Policy, a former deputy assistant secretary for intelligence at the Treasury Department.
As the tensions mount, the world's intelligence and law enforcement agencies are keeping a close watch on a network they say has a taste for risk and for striking in unexpected places.
"If there are hostilities, they would hit in the Middle East, Latin America, Europe," said Faddis, the CIA counterterror veteran. "And the U.S., if they could."
