Iran International
The Canadian Security Intelligence Service told Iran International that in more than one case its efforts to counter Iranian intelligence services and their proxies involved detecting, investigating and disrupting potentially lethal threats in Canada.
CSIS said it assesses that “Iranian threat-related activities directed at Canada and its allies are likely to continue in 2026.”
The agency declined to discuss specific investigations or operational details, citing the need to protect its sources, tradecraft and methods.
Iranian intelligence services and their proxies have targeted individuals they perceive as threats to the Iranian government, according to CSIS.
“In more than one case this involved detecting, investigating, and disrupting potentially lethal threats against individuals in Canada,” the agency said.
It added that it works with foreign partners and domestic law enforcement to counter such activity and engages communities across Canada to strengthen their resilience against potential threats.
The Royal Canadian Mounted Police (RCMP) also told Iran International that it was aware of reporting and allegations about possible foreign involvement in the incidents but declined to attribute them to Iran or another state while investigations remain underway.
“As these matters remain under investigation, the RCMP is not in a position to comment on specific intelligence, investigative findings, or potential attribution,” the force said.
The RCMP said it was aware of foreign interference activity in Canada involving several states, including Iran, and takes allegations of foreign interference, transnational repression and foreign state-linked criminal activity seriously.
The RCMP said it works with Canadian and international partners through intelligence sharing, threat assessments, coordinated investigations and enforcement actions.
Gun-for-hire investigations
The responses come amid investigations into suspected gun-for-hire networks operating in the Greater Toronto Area.
Toronto police say young people are being recruited through encrypted messaging apps to carry out attacks for payment, while investigators are still working to determine who is directing and financing the violence.
Police have identified a recurring pattern in some of the attacks involving stolen vehicles, encrypted messaging apps and gunmen recording shootings on their phones.
Police say recruits are required to record the attacks as proof in order to receive payment.
Toronto police said ballistic evidence linked two firearms seized during the investigation to numerous shootings across the Greater Toronto Area, including the attack on the US Consulate.
Iran International previously reported in June that an armed assailant fired 17 rounds at a Toronto athletic facility owned by Iranian-Canadian opposition activist Salar Gholami, hours after the killing of senior Iranian officials in Tehran.
The facility has served as a gathering place for opponents of the Islamic Republic and a hub for anti-regime demonstrations.
Surveillance footage captured an assailant whose physical profile was described in the report as consistent with young individuals allegedly recruited in other shootings.
The attack has not been publicly established as part of the same criminal network involved in other shootings under investigation in Toronto.
Conservatives call for action
Conservative Party leader and opposition leader Pierre Poilievre has warned that foreign-backed networks are exploiting criminal groups to carry out attacks in Canada.
"Iran's terrorist regime is suspected of financing gun-for-hire shootings on Canadian soil. Synagogues, a school, businesses, and the U.S. Consulate targeted. Jewish Canadians and Iranian dissidents are being terrorized," Poilievre said.
He called on the federal government to identify and deport Iranian Revolutionary Guard operatives unlawfully present in Canada.
Canada and more than two dozen other countries said earlier this month that they condemned Iran’s use of violent attacks, including lethal plotting, arson, sabotage, cyberattacks and other hostile activities, and pledged to identify, investigate and disrupt such activity.
Two men accused of assisting Iranian intelligence knowingly helped prepare attacks on Iran International journalists, a prosecutor told a London court on Tuesday, citing photographs and videos of addresses linked to them.
At Woolwich Crown Court, prosecutors alleged that Shapoor Qalehali Khani Noori, 57, and Farhad Javadi Manesh, 46, knowingly assisted Mostafa Sepahvand, 41, in targeting Iran International journalists Mojtaba Pourmohsen and Kambiz Hosseini.
All three defendants deny the charges brought under Britain's National Security Act. Prosecutors allege they gathered information for Iranian intelligence to prepare for serious violence against at least one target, with Sepahvand expected to carry out an attack.
Prosecutor Bill Emlyn Jones accused Noori of being a trusted member of Sepahvand's surveillance team, citing photographs, messages and mobile phone location data. Noori denied knowingly participating in the alleged plot, saying he had taken photographs and videos at Sepahvand's request without understanding their purpose.
Late-night filming and repeated visits
Jones questioned Noori about a video filmed on St Dunstan's Avenue, an address linked to Hosseini, and sent to Sepahvand via WhatsApp at 11:56 p.m. on December 12, 2024.
Noori acknowledged taking the video but said they had gone for a drive because they were bored. He said Sepahvand asked him to film near a park, send the recording and delete it.
Jones challenged that account, suggesting the camera had deliberately focused on a particular house rather than randomly filming the area.
The prosecutor also cited phone and vehicle location data indicating repeated visits to the Malthouse Court area, linked to Pourmohsen, arguing that the movements were part of coordinated surveillance.
Noori said he did not know the significance of the locations and believed the recordings might have been connected to Sepahvand's business activities.
Jones also questioned him about four videos recorded over more than three hours in Kingston upon Thames on March 4, 2025, near premises associated with a business called Need a Fixer.
The prosecutor cited messages discussing recordings at hourly intervals to demonstrate Sepahvand's presence at a location, suggesting Noori knowingly participated in reconnaissance intended to help identify and ultimately attack targets.
Noori denied the allegation, saying he had never suspected Sepahvand of planning violence.
Prosecutor challenges Noori over police interviews
Jones questioned why Noori had not identified Sepahvand as a friend or explained the recordings during police interviews following his arrest in May 2025.
The prosecutor suggested Noori had remained silent because he had not yet developed an innocent explanation for his activities.
Noori said he had followed his solicitor's advice and was distressed by accusations that he had assisted a government he had fled.
He told the court he had been imprisoned three times in Iran and fled the country in 2019 because he feared for his life. During questioning by his defense lawyer, the court heard that Noori was granted asylum in Britain in 2024.
Earlier hearing examined £150,000 payment for alleged attack
During Monday's hearing, prosecutors challenged Sepahvand's claim that he had been deceiving the Revolutionary Guards, arguing that he was motivated by money and assistance with a criminal case in Iran.
Sepahvand acknowledged that a proposed £150,000 payment was conditional on harming a journalist but maintained that he demanded the sum to deter the IRGC and never intended to carry out an attack.
Noori and Javadi Manesh accept visiting locations and taking photographs or videos but deny knowing they were assisting Iranian intelligence.
The trial is scheduled to resume on November 2.
A Kuwaiti court sentenced three men to death after convicting them of collaborating with Iran and Hezbollah and plotting to assassinate senior officials, including First Deputy Prime Minister and Interior Minister Sheikh Fahad Al-Yousef Al-Sabah.
Kuwait Times reported that the State Security Criminal Court’s anti-terrorism division handed down the sentences on Monday over charges including espionage, planning attacks against Kuwait, membership in an outlawed organization and actions deemed harmful to national interests.
The death sentences are not final and are subject to review by Kuwait’s Court of Appeals.
Explosives alleged in assassination plan
Prosecutors accused some of the defendants of preparing to use explosives in the assassination plot, while one was accused of attempting to smuggle explosives into Kuwait for use in the planned attacks.
The court said the defendants sought to undermine state security, create instability and weaken public confidence in the authorities’ ability to maintain order, according to Kuwait Times.
AFP, citing two judicial sources, identified one of those sentenced to death as Hussein Abdallah al-Maatouq, a religious figure and secretary-general of the National Islamic Alliance. The sources said another of the three had previously been convicted on terrorism charges in 2016, later pardoned by Kuwait’s emir and arrested again in April.
Similar cases in Kuwait
The ruling follows another Iran- and Hezbollah-linked espionage case in Kuwait earlier this year.
In July, Kuwait’s State Security Court of Appeal sentenced a Kuwaiti citizen to life imprisonment after overturning an earlier 10-year term. Local reporting said he had been convicted of cooperating with Iran’s Revolutionary Guards and Hezbollah and had traveled to Qom, where prosecutors said he received weapons and drone training.
The allegations in that case included meetings with security figures linked to Iran and Hezbollah and preparations for activity deemed harmful to Kuwait’s national security.
Bahrain has also prosecuted alleged IRGC networks
Bahrain has brought several similar cases this year involving alleged cooperation with Iran’s Revolutionary Guards.
In May, a Bahraini court sentenced nine defendants to life imprisonment and two others to three years after convicting them of collaborating with the IRGC in what authorities described as hostile and terrorist activities against the kingdom.
Bahrain’s Interior Ministry had earlier said it arrested dozens of people it linked to the IRGC as authorities investigated alleged networks operating during the wider regional conflict.
The cases have unfolded amid heightened tensions between Iran and states across the Persian Gulf, with governments in the region increasing scrutiny of alleged Iranian-linked security and espionage networks.
A man accused of plotting attacks on Iran International journalists faced a prosecution challenge to his claim that he was deceiving the Revolutionary Guards, with prosecutors arguing he acted for money and help resolving his criminal case in Iran.
At Woolwich Crown Court on Monday, prosecutor Bill Emlyn Jones challenged contradictions between Mostafa Sepahvand’s testimony and his messages to a contact in Iran, accusing him of being a “skilled liar.”
Sepahvand later acknowledged that a proposed £150,000 payment was conditional on harming a journalist, but maintained that he had demanded the sum to deter the IRGC and never intended to carry out an attack.
Sepahvand, 41, is on trial alongside Farhad Javadi Manesh, 46, and Shapoor Qalehali Khani Noori, 57. All three deny charges under Britain’s National Security Act.
Prosecutors allege they gathered information for Iranian intelligence to prepare for serious violence against at least one target, with Sepahvand expected to carry out an attack. The alleged targets included Iran International journalists Mojtaba Pourmohsen and Kambiz Hosseini.
Jones put it to Sepahvand that either his messages to Mostafa Ghorbani or his account to the jury was untrue. Following the prosecutor’s accusation that he was a skilled liar, Sepahvand shouted in English: “I never did this.” The court then took a break.
When the hearing resumed, his defense barrister, Tyrone Smith, asked him to confirm that the £150,000 discussed in his messages related to causing harm to a journalist. Sepahvand answered yes.
Smith revisited a March 20, 2025, voice message in which Sepahvand discussed the payment, locating a target and carrying out the task when the money was ready.
Asked whether he believed the money would ever be paid, Sepahvand said no. He maintained that his demands were intended to scare off the IRGC.
“I never wanted to harm anyone,” he told the court, saying he had been deceiving the group throughout because he hated it. Asked whether he had ever seen or harmed any of the journalists, he answered no.
Earlier questioning examined Sepahvand’s repeated attempts to reach Ghorbani in late December 2024 and January 2025.
Sepahvand said he was anxious about his criminal case in Iran and wanted Ghorbani and another contact, Amin, to enlist the help of a man referred to as “Haji.”
He said Amin had told him the case had been stopped or canceled, but that this was a lie.
A translated Iranian judicial document examined in court indicated that Sepahvand’s sister appeared on his behalf on January 7, 2025, to appeal convictions dating from 2014 for 32 burglary offenses. The appeal was unsuccessful, although the judge altered the sentence.
Sepahvand said his sister appealed again and that he also pleaded guilty. He maintained that repeated calls to Ghorbani concerned efforts to resolve the case.
He attributed other exchanges about money to car trading, a bodywork workshop and loans that had to be repaid with interest.
During the defense questioning, Sepahvand reaffirmed that threats against his family had prompted his actions. Smith referred to his account that he had sought to appear cooperative without actually assisting a foreign intelligence service or intending to harm anyone.
Smith also asked whether Sepahvand’s solicitor had contacted counterterrorism police several times between July and December 2025 to say he had information to provide, and whether police had declined to speak to him until he pleaded guilty. Sepahvand answered yes.
He confirmed that he had asked his solicitor to pass on the name of Navid, a contact previously discussed during the trial.
Prosecutors reject Sepahvand’s claim that he acted under duress and deliberately performed the surveillance poorly.
According to the prosecution’s account of their defenses, Javadi Manesh and Noori accept visiting locations and taking photographs and videos but say they did not know they were assisting Iranian intelligence.
A billionaire donor to Britain’s Reform UK party was previously involved in a business venture with Astan Quds Razavi, a powerful Iranian religious foundation under the authority of the country’s supreme leader, the Guardian reported.
Hossein “Sasan” Ghandehari, an Iranian-born British businessman who has pledged millions of pounds to Reform UK, was the main investor behind a telecoms project in Iran between 2013 and 2016, according to a French arbitration ruling reviewed by the newspaper.
Ghandehari’s HP Trust ultimately owned Ori Group, which acquired a 49% stake in Omran Razavi International Co, a joint venture established to build and supply a fiber-optic network carrying telecommunications traffic across Iran.
Partnership with Astan Quds Razavi
The remaining 51% of the venture was owned by Astan Quds Razavi, or AQR, a multibillion-pound religious foundation based in Mashhad.
At the time, AQR was headed by Abbas Vaez Tabasi, who had been appointed by Islamic Republic founder Ruhollah Khomeini and remained in the post until his death in 2016.
AQR is one of Iran’s major bonyads, large quasi-public foundations with extensive economic interests. The United States sanctioned it in 2021, saying it controlled major parts of Iran’s economy and operated for the benefit of then-supreme leader Ali Khamenei and other senior officials.
Ghandehari’s lawyers told the Guardian that describing him simply as having worked with Iran would be misleading. They said the project was intended to expand access to information and promote political change, and that AQR was the only viable partner capable of enabling the project to proceed.
Venture collapsed in 2016
The joint venture ended around 2016 after Vaez Tabasi’s death and the appointment of a more hardline leadership at AQR, the Guardian reported.
AQR subsequently took full control of the project. Around the same period, project chairman Mohammed Reza Noory was imprisoned in Iran and later sentenced to 18 years.
Ghandehari’s lawyers said he himself was later targeted by Iran’s Supreme National Security Council with accusations that he had worked with hostile Western powers. They described those allegations as false.
Ghandehari has said he has not been to Iran for three decades and that his wealth has no connection to the country. His representatives also said family assets in Iran were confiscated in 2016.
Links to another Reform donor
The Guardian also reported that Ghandehari had business ties to another Reform UK donor, John Richard Simpson.
Ghandehari’s HP Trust had owned Orico General Trading LLC, a company contracted to supply telecommunications equipment from France’s Alcatel-Lucent and transport it from Dubai to Iran. After 2016, ownership of Orico was transferred to Simpson, who told the newspaper he had acquired the company to wind down its operations after the project ran into difficulties.
Simpson’s design firm, Interior Architecture Landscape, counts the Ghandehari family among its clients and donated £200,000 to Reform UK last year, according to the Guardian.
Farage has taken a hard line on Tehran
Ghandehari emerged as a major Reform donor this year, pledging to make regular contributions worth more than £1 million and donating £50,000 to party leader Nigel Farage for World Economic Forum passes.
Farage has taken a strongly critical position toward the Islamic Republic and has supported US pressure on Tehran.
The Guardian said Ghandehari’s past business relationship with AQR raises questions about the extent of his previous dealings with state-linked entities in Iran, although his lawyers said the project was approved by authorities in France and the United States and was intended to expand internet access rather than support the Iranian government.
An Iranian state-sponsored hacking group used command-and-control infrastructure hosted in the United States this year after a months-long pause in operations, according to cybersecurity firm Semperis.
The group, known as Prince of Persia and also tracked as Infy, has operated for nearly two decades and has primarily targeted Iranian dissidents, along with government and private-sector organizations in the US, Europe and the Middle East.
Semperis researcher Tomer Bar said he identified a command-and-control server in the US in August, the first time the group had been found using US-based infrastructure since 2016.
Operations resumed after months-long pause
SecurityWeek, citing Semperis, reported that the group halted activity for about three months after the US-Israel war with Iran began on February 28.
Semperis said operations resumed on May 27, when the group deployed new infrastructure and restarted data theft. Within a week, one of its malware tools had extracted more than 1,800 files from a single victim, according to SecurityWeek.
Bar said the group’s victim count remained relatively small, which could indicate highly targeted operations or difficulty compromising new systems.
New infrastructure hidden among legitimate sites
Semperis said the group changed its hosting strategy after returning to activity, moving away from virtual private servers and instead using shared hosting in the United States.
The server identified in August was linked to Tornado, one of the group’s newer malware families, which can steal files through Telegram-based channels.
Bar said the use of US shared hosting was unusual for this particular group because it allowed the infrastructure to blend in with thousands of legitimate websites and other online services.
“This is the last place we expected to find Prince of Persia hiding,” he said.
Semperis also said the group later began building additional infrastructure behind Cloudflare, making its command-and-control systems harder to trace directly.
Iranian cyber activity under growing scrutiny
The findings come as US authorities and cybersecurity researchers continue to report Iranian-linked cyber activity targeting both dissidents and critical infrastructure.
In September, NBC News reported that Iranian hackers had recently targeted US water, telecommunications and energy systems, citing government and industry cyberthreat sources. Those attempts had not caused major disruption.
US prosecutors have also pursued cases against alleged Iranian hackers accused of working on behalf of state institutions.
Last month, Montenegro approved the extradition of Iranian-Turkish hacker Amir Barati to the United States, where he faces charges over an alleged campaign targeting universities and research institutions for entities including the Revolutionary Guards.
US prosecutors say that broader campaign compromised thousands of academic accounts and resulted in the theft of more than 31 terabytes of data.