Sir Ken McCallum, the Director General of MI5, stated on Tuesday that the United Kingdom and Europe are facing an increase in "hybrid tactics" from Russia and Iran. In an annual threat update at MI5 headquarters in London, McCallum said these activities are targeting civilians, private businesses, and community sites rather than government-controlled assets. He identified Russia as the primary threat and noted a major shift in Iranian operations, which he said have moved toward harder targets.
The spy chief reported that MI5 analysts have observed both nations using criminal proxies to carry out acts of intimidation and sabotage. According to McCallum, the U.K. has seen more than 50 arrests related to Iranian hybrid campaigns over the last year. He specifically highlighted a wave of arson and sabotage incidents targeting Jewish communities and military sites. Many of these actions have been claimed by the group Harakat Ashab al-Yamin al-Islamiya (HAYI), which U.K. authorities state is tied to Iran’s Quds Force.
Regarding Russia, McCallum stated that Moscow is escalating its hybrid warfare while attempting to stay below the threshold of NATO's Article 5, which mandates a collective defense response. Incidents linked to Russia include an alleged airspace violation in Estonia, a thwarted assassination plot in Germany, and the monitoring of undersea cables in Norwegian waters. Additionally, several arson attacks and drone-related incidents at defense factories supplying Ukraine—located in France, Germany, Poland, and Estonia—have been attributed to Russian operatives or proxies by local authorities.
The scale of these activities includes dozens of reported incidents across European nations, including Belgium, the Netherlands, France, Germany, Poland, Estonia, Lithuania, and the U.K. Residents near infrastructure may notice increased military or police presence, such as the deployment of U.K. and Norwegian vessels to protect undersea cables reported on April 9. For workers in the defense industry, the risks involve physical sabotage, such as the August fire at a drone factory in Poland or the September 23 arson at a Starlink station. These actions are described by security officials as attempts to disrupt supply lines and communications without triggering a formal state-on-state war.
What happens next depends on legal proceedings and ongoing investigations. In Manchester, two Iranian nationals face terrorism charges following an alleged plot against a Jewish community. In Swindon, Joshua Cammidge faces charges related to allegedly sharing the locations of drone factories with people linked to Russian intelligence. European intelligence agencies continue to investigate links between HAYI and the Quds Force, while NATO remains on alert for any Russian actions that might cross the collective defense threshold.