- Rising tensions between Iran and pro-US/pro-Israel Balkan states have moved beyond rhetoric, with diplomatic warnings, cyberattacks, and terrorism designations signaling a real risk of spillover into Southeast Europe.
- Iran has a long-standing but evolving presence in the Balkans, shifting from limited religious and ideological influence efforts to more covert activities, including cyber operations, intelligence gathering, and use of the region as a logistical hub.
- Recent incidents—including cyberattacks in Albania, past operations like the Burgas bombing, and increased activity by Iran-linked groups—highlight the region’s vulnerability due to weak institutions, corruption, and security gaps.
- The most likely escalation scenarios involve targeted actions rather than mass-casualty attacks, including strikes on government infrastructure or assassination attempts against pro-US and pro-Israel political figures, potentially carried out through proxies or criminal networks.
The increased risk of escalation in the war with Iran raises security concerns not only in its region but beyond. A recent statement by the US Embassy in Tirana, Albania, warned that the country’s public venues, such as tourist sites, shopping malls, hotels, clubs, and restaurants, may be potential targets of groups associated with Iran. The previous week, Albania joined the US in designating Iran a “state sponsor of terrorism”. Meanwhile, Iran issued a direct diplomatic warning to Bulgaria regarding the U.S. military’s use of its airports, which Bulgarian officials have since confirmed. These developments prompt a serious discussion: Can Iran seriously plan retaliation with terrorist attacks beyond the Middle East, in the ‘hinterland of Europe’?!
In fact, the security-related tensions between pro-Israel and pro-US countries in Southeast Europe and Iran are not an ‘emerging situation’ amid the ongoing war. Albania accepted approximately 3,000 members of the Iranian opposition group People’s Mojahedin Organization of Iran (MEK) between 2013 and 2016, following a U.S.-brokered agreement to relocate them from insecure locations in Iraq. Based in a fortified camp in Manez, Albania, the group continues to oppose the Iranian government from exile, causing significant diplomatic and security tensions. Iran-linked hackers from “Homeland Justice” have recently intensified their cyber campaign against Albania, leaking internal data from both the Albanian Post and the Parliament’s email systems. Relations between the two nations have been nonexistent since 2022, when Albania cut diplomatic ties following a previous series of significant Iranian-led cyberattacks.
Similarly, Kosovo took repressive measures against pro-Iranian militants who called for ‘revenge’ on social media after the US killed Qassem Suleimani and advocated ‘terrorist acts’. The country’s official narrative consistently portrays Iran as “part of the ‘evil triangle’, together with China and Russia, that is involved in destabilization efforts in Southeast Europe”. Both Albania and Kosovo have also demonstrated their high-level support for the Israeli and US governments by recently visiting the Knesset and pledging to contribute to a 32,000-strong force planned to operate in Gaza, as part of Trump’s Board of Peace.
Bosnia and Herzegovina, on the other hand, co-sponsored a UN Security Council resolution condemning Iranian attacks on Gulf countries the previous month. This move occurred despite the absence of a coordinated decision by the tripartite Presidency of Bosnia and Herzegovina, signaling a push to align with Western foreign policy.
Furthermore, Montenegro, North Macedonia, and Serbia recently aligned with the Council of the European Union’s decision to designate Iran’s Islamic Revolutionary Guards Corps as a terrorist organization. The decision came in February 2026 as a follow-up to the EU’s restrictive measures to combat terrorism.
Accordingly, the European Union Terrorism Situation and Trend Report 2025 notes that Iran-linked groups and their propaganda are fueling regional instability. For instance, the report mentions that groups such as Hezbollah and the Yemeni Ansar Allah (Houthis) have spread propaganda that, while not always directly inciting violence in the EU, fuels hatred toward Israel and promotes anti-Semitism. Another notable point in the report is the arrest of nine individuals in Istanbul in February 2024 on charges of supporting members of ISKP (Islamic State Khorasan Province) who were traveling from Iran. The report highlights that regional instability in the Middle East, often involving Iranian interests and proxies, continues to provide potential destinations for foreign terrorist fighters (FTFs) and may pave the way for new external operations against the EU.
Given the dynamic circumstances in Southeast Europe, the risk of escalation of the ongoing war with Iran into the region is significant. To contextualize this risk, articulating Iran’s presence in the region is a foremost priority.
Historically, Iran established constructive economic relations with Serbia, popular due to its closeness to Moscow and Beijing. Following the collapse of Yugoslavia, Iran consistently attempted to build a religious hegemony over the Muslim population in the region. Some means of attempted influence are as follows: (1) translating its religious literature into regional languages, (2) a number of Sunni intellectuals and religious activists converted to Shia, who try to establish a pan-Islamist political stream in the region; (3) contracting local traditional and social media (radio stations, journals/magazines, influencers, etc.) for Shiite propaganda.
While those efforts and their impact remained limited, security concerns stemming from Iran were always ‘alarming’ for the region. The Balkans are viewed by Tehran as a ‘quiet’ logistical platform. Iran exploits the region’s relatively lax security, weak state institutions, and pervasive corruption to establish bases that operate outside the purview of global intelligence agencies. The most significant example of this was the 2012 Burgas bus bombing in Bulgaria, in which a Hezbollah operative targeted Israeli tourists. Moreover, credible state sources suggested that Hezbollah agents routinely cross borders (e.g., between Bulgaria and Serbia) to gather intelligence on infrastructure, administrative buildings, and Israeli-US business interests.
The activities of Iranian agents in the region are also known in Albania. In 2020, Albania’s institutions imposed a 10-year prison sentence on Bijan Pooladrag for crimes related to terrorism, on suspicion of being an Iranian agent monitoring Iranian MEK members in the country. Accordingly, the very recent cyberattacks against Albania by Iranian state and non-state actors mark a new dimension of security threat for the region. Moreover, they expose the vulnerability of the region’s infrastructure to hybrid threats.
Is a terrorist attack in the region by Iran, state and/or non-state actors, realistic? The rapid cluster of terrorist attacks across five European countries over the last two months by the Shi’ite militant collective/group Harakat Ashab al-Yamin al-Islamiyyah (HAYI) suggests a serious plan to expand operations on the continent. Given that all attacks were directed at individuals or entities publicly known for a pro-Israel and pro-US stance, this pattern suggests that the region, especially the governments of Albania, Kosovo, Montenegro, and North Macedonia, which are firmly supporting the Israeli government in recent Middle East wars, may be potential new targets for terrorist attacks. Furthermore, these attacks may be specifically targeting state entities rather than civilian infrastructure. Rationally, it is not in Iran’s interest to lose the momentum of being increasingly perceived as a victim, especially by the Muslim-Sunni population in the region, as well as the majority of public opinion, which has recently reflected increased dissatisfaction with the positioning of their respective governments in current foreign policy, fully aligned with Israel and the United States.
Besides terrorist attacks on state infrastructure, assassination attempts on regional political actors who have been notably vocal in supporting Israel and the U.S. in recent conflicts may be another modus operandi of the Iranian state or non-state actors. Given the region’s fertile ground for organized crime, murder-for-hire linked to a foiled plot to assassinate politicians and government officials might not be surprising. Very recently, the U.S. Department of Justice announced the conviction of the Islamic Revolutionary Guard Corps (IRGC)-trained operative Asif Merchant for murder-for-hire and for attempting to commit an act of terrorism against U.S. politicians and government officials.
To sum up, Southeast Europe has become a high-risk zone for ‘proxy’ escalation as regional governments increasingly align with U.S. and Israeli interests. While Iran historically used religious propaganda to gain influence, the strategy has shifted toward more aggressive threats, including severe cyberattacks and the use of the Balkans as a ‘quiet’ logistical base for intelligence gathering. Given the recent wave of attacks by groups like HAYI and the EU’s 2026 designation of the IRGC as a terrorist organization, the region faces a significant risk of future retaliation. This threat may manifest as targeted strikes on state infrastructure or assassination plots against pro-Israeli and U.S. political figures, exploiting the region’s weak institutions and organized crime networks.
